{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/", "slug": "dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection", "url": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/" }, "title": "Check prerequisites before enabling kernel hardware stack protection", "summary": "How should a pilot for kernel hardware-enforced stack protection be prepared?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "continuity-recovery", "label": "Continuity & recovery", "alt": "Paired infrastructure paths converging on a stable recovered service.", "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "business-continuity", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-08T18:16:57+00:00", "modified_at": "2026-09-08T18:17:13+00:00", "reviewed_on": "2026-09-08", "reading_minutes": 1, "word_count": 215, "potentially_affected": "Use this review when evaluating the protection on a Windows system.", "dse_recommendation": "Inventory the hardware and installed drivers for the pilot system, and name the owner of any compatibility investigation.", "primary_source": { "name": "Kernel Mode Hardware-enforced Stack Protection", "url": "https://learn.microsoft.com/en-us/windows-server/security/kernel-mode-hardware-stack-protection", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft describes kernel-mode hardware stack protection as a defense against return-oriented programming attacks on kernel stacks. The mechanism pairs kernel stacks with shadow stacks to check control-flow integrity. Virtualization-based security and hypervisor-enforced code integrity must be enabled before the feature is enabled; the documentation also specifies supported hardware and Windows prerequisites. Microsoft documentation.

\n

Applicability

\n

Use this review when evaluating the protection on a Windows system. Verify the exact operating-system, application, processor, and security prerequisites in the current source. Do not infer eligibility from the article’s placement within Windows Server documentation.

\n

DSE recommendation

\n

Inventory the hardware and installed drivers for the pilot system, and name the owner of any compatibility investigation. Record the starting state of the prerequisite protections. Agree on essential workload tests and a supported recovery procedure before enabling the feature. Select a representative system whose failure can be investigated without interrupting an unapproved production workload.

\n

Verification

\n

After the approved change and any requested restart, inspect the protection state and record whether it became active. Exercise the chosen applications and device functions. Preserve reported incompatibilities or unexpected failures with the relevant driver and system details. Expand only after the pilot owner accepts both the security-state evidence and the workload results.

\n

Official references

\n

Microsoft Learn: Kernel Mode Hardware-enforced Stack Protection. Source reviewed September 8, 2026.

", "content_text": "Source facts\nMicrosoft describes kernel-mode hardware stack protection as a defense against return-oriented programming attacks on kernel stacks. The mechanism pairs kernel stacks with shadow stacks to check control-flow integrity. Virtualization-based security and hypervisor-enforced code integrity must be enabled before the feature is enabled; the documentation also specifies supported hardware and Windows prerequisites. Microsoft documentation.\nApplicability\nUse this review when evaluating the protection on a Windows system. Verify the exact operating-system, application, processor, and security prerequisites in the current source. Do not infer eligibility from the article’s placement within Windows Server documentation.\nDSE recommendation\nInventory the hardware and installed drivers for the pilot system, and name the owner of any compatibility investigation. Record the starting state of the prerequisite protections. Agree on essential workload tests and a supported recovery procedure before enabling the feature. Select a representative system whose failure can be investigated without interrupting an unapproved production workload.\nVerification\nAfter the approved change and any requested restart, inspect the protection state and record whether it became active. Exercise the chosen applications and device functions. Preserve reported incompatibilities or unexpected failures with the relevant driver and system details. Expand only after the pilot owner accepts both the security-state evidence and the workload results.\nOfficial references\nMicrosoft Learn: Kernel Mode Hardware-enforced Stack Protection. Source reviewed September 8, 2026.", "content_markdown": "## Source facts\n\nMicrosoft describes kernel-mode hardware stack protection as a defense against return-oriented programming attacks on kernel stacks. The mechanism pairs kernel stacks with shadow stacks to check control-flow integrity. Virtualization-based security and hypervisor-enforced code integrity must be enabled before the feature is enabled; the documentation also specifies supported hardware and Windows prerequisites. [Microsoft documentation](https://learn.microsoft.com/en-us/windows-server/security/kernel-mode-hardware-stack-protection).\n\n## Applicability\n\nUse this review when evaluating the protection on a Windows system. Verify the exact operating-system, application, processor, and security prerequisites in the current source. Do not infer eligibility from the article’s placement within Windows Server documentation.\n\n## DSE recommendation\n\nInventory the hardware and installed drivers for the pilot system, and name the owner of any compatibility investigation. Record the starting state of the prerequisite protections. Agree on essential workload tests and a supported recovery procedure before enabling the feature. Select a representative system whose failure can be investigated without interrupting an unapproved production workload.\n\n## Verification\n\nAfter the approved change and any requested restart, inspect the protection state and record whether it became active. Exercise the chosen applications and device functions. Preserve reported incompatibilities or unexpected failures with the relevant driver and system details. Expand only after the pilot owner accepts both the security-state evidence and the workload results.\n\n## Official references\n\n[Microsoft Learn: Kernel Mode Hardware-enforced Stack Protection](https://learn.microsoft.com/en-us/windows-server/security/kernel-mode-hardware-stack-protection). Source reviewed September 8, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/", "url": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-08" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Check prerequisites before enabling kernel hardware stack protection", "item": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/", "url": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/", "headline": "Check prerequisites before enabling kernel hardware stack protection", "description": "How should a pilot for kernel hardware-enforced stack protection be prepared?", "abstract": "How should a pilot for kernel hardware-enforced stack protection be prepared?", "articleBody": "Source facts\nMicrosoft describes kernel-mode hardware stack protection as a defense against return-oriented programming attacks on kernel stacks. The mechanism pairs kernel stacks with shadow stacks to check control-flow integrity. Virtualization-based security and hypervisor-enforced code integrity must be enabled before the feature is enabled; the documentation also specifies supported hardware and Windows prerequisites. Microsoft documentation.\nApplicability\nUse this review when evaluating the protection on a Windows system. Verify the exact operating-system, application, processor, and security prerequisites in the current source. Do not infer eligibility from the article’s placement within Windows Server documentation.\nDSE recommendation\nInventory the hardware and installed drivers for the pilot system, and name the owner of any compatibility investigation. Record the starting state of the prerequisite protections. Agree on essential workload tests and a supported recovery procedure before enabling the feature. Select a representative system whose failure can be investigated without interrupting an unapproved production workload.\nVerification\nAfter the approved change and any requested restart, inspect the protection state and record whether it became active. Exercise the chosen applications and device functions. Preserve reported incompatibilities or unexpected failures with the relevant driver and system details. Expand only after the pilot owner accepts both the security-state evidence and the workload results.\nOfficial references\nMicrosoft Learn: Kernel Mode Hardware-enforced Stack Protection. Source reviewed September 8, 2026.", "datePublished": "2026-09-08T18:16:57+00:00", "dateModified": "2026-09-08T18:17:13+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260908-014-check-prerequisites-before-enabling-kernel-hardware-stack-protection/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Check prerequisites before enabling kernel hardware stack protection" }, "articleSection": [ "Business Continuity", "IT" ], "keywords": [ "Business Continuity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Business Continuity", "url": "https://update.dsesecurity.com/topic/business-continuity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 215, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Kernel Mode Hardware-enforced Stack Protection", "url": "https://learn.microsoft.com/en-us/windows-server/security/kernel-mode-hardware-stack-protection" } } ] } }