We aims to provide in house support to our colleagues and the Engineers for any sort of technical help.You can raise your technical queriesor browse for any solutions for the probelms through our groups.We provide driver support,OS support and utility support too to make your life a better one.

Our Mission

Transform HCL Infosystems LTD into services and solution centric organization

Saturday, July 30, 2011

Boot Parameters to Configure DEP and PAE

This topic explains how to use boot parameters to enable, disable, and configure Data Execution Prevention (DEP) and Physical Address Extension (PAE) on operating systems that support these features.
For information about the boot parameters for DEP on operating systems prior to Windows Vista, including operating system support and the default values of the parameters, see /noexecute and /execute. For similar information about PAE, see /pae and /nopae.
For information about the boot parameters for DEP and PAE on Windows Vista and later, see the BCDEdit /set command and the nx and pae options.
Important  DEP is a highly effective security feature that should not be disabled unless you have no alternative. The default settings for DEP and PAE are optimal for most systems. Do not change the default settings unless they interfere with essential processing tasks. This section is included to show you how to configure these features, but it should not be interpreted as a recommendation to change the default settings.

DEP and PAE Boot Parameters

On operating systems prior to Windows Vista, DEP and PAE are enabled at boot time and are configured by using the following four boot parameters:
On Windows Vista and later, DEP and PAE are enabled at boot time and are configured by setting values for the nx and pae parameters using the BCDEdit /set command.
These boot parameters have conflicting effects. To configure DEP and PAE, use only the parameter combinations that are described in the documentation for each parameter and discussed in this topic. Do not experiment with conflicting parameters, especially on a production system.

The Interaction of DEP and PAE Boot Parameters

There are two types of DEP:
  • Hardware-enforced DEP enables DEP for both kernel-mode and user-mode processes. It must be supported by the processor and the operating system.
  • Software-enforced DEP enables DEP only on user-mode processes. It must be supported by the operating system.
DEP is supported by Windows XP with SP2, Windows Server 2003 with SP1, Windows Vista, and later versions of Windows.
On 32-bit versions of Windows, hardware-enforced DEP requires PAE, which is supported by all Windows operating systems that support DEP. When DEP is enabled on a computer with a processor that supports hardware-enforced DEP, Windows automatically enables PAE and ignores the boot parameter values that disable it.
The parameter combinations for each Windows operating system are summarized in the following section.

DEP and PAE Parameter Combinations

The following list describes the boot parameter combinations that can be used to configure DEP and PAE.
Note   In the examples for Windows Vista and later, the optional {ID} is the GUID for the specific Windows boot loader boot entry that you want to configure. If you do not specify an {ID}, the command modifies the current operating system boot entry. For more information, see the BCDEdit /set command .
ActionPrior to Windows VistaWindows Vista and later
To enable DEP
(Select one parameter combination)
When DEP is enabled on computers that support hardware-enforced DEP, these parameter combinations also enable PAE.
/noexecute=alwayson/noexecute=optin/noexecute=optout
/set [{ID}] nx AlwaysOn
/set [{ID}] nx OptIn
/set [{ID}] nx OptOut
To enable DEP and PAE on systems with software-enforced DEP
(Select one parameter combination)
On computers that support hardware-enforced DEP, PAE is automatically enabled when you enable DEP.

/noexecute=alwayson /pae
/noexecute=optin /pae
/noexecute=optout /pae
/set [{ID}] nx AlwaysOn
/set [{ID}] pae default
/set [{ID}] nx OptIn
/set [{ID}] pae default
/set [{ID}] nx OptOut
/set [{ID}] pae default
To disable DEP, but enable PAE
/noexecute=alwaysoff /pae
(Windows XP with SP2)
/set [{ID}] nx AlwaysOff
/set [{ID}] pae ForceEnable
To disable DEP, but enable PAE

/noexecute=alwayoff
/noexecute=alwaysoff /pae
(Windows Server 2003 with SP1 only)
(These parameter combinations are equivalent.)
/set [{ID}] nx AlwaysOff
/set [{ID}] pae ForceEnable
To disable both DEP and PAE

/noexecute=alwaysoff
/noexecute=alwaysoff /nopae
(Windows XP with SP2)
(These parameter combinations are equivalent.)
/set [{ID}] nx AlwaysOff
/set [{ID}] pae ForceDisable
To disable both DEP and PAE


Source:technet magazine.Microsoft
/execute
(Windows Server 2003 with SP1 only)



No comments:

Post a Comment