Set-ProcessMitigation

Set-ProcessMitigation -System -Enable DEP,SEHOP,ASLR

Enables system exploit mitigations with Set-ProcessMitigation: DEP, SEHOP, and ASLR for all processes.

Run it when you want to enable exploit protections at the system level: Set-ProcessMitigation configures Windows mitigations (DEP, ASLR, SEHOP, CFG, and process-level ones with the mitigation policy) — the -System switch applies base mitigations to all processes. It's the defense layer against vulnerability exploitation: payloads that rely on stack execution (DEP), address randomization (ASLR), or the SEH chain (SEHOP) fail with mitigations active. In hardening, it's the baseline configuration for any modern Windows (mitigations come enabled by default on new versions; the command verifies and enforces them).

Don't use it blindly: mitigations break legacy applications (programs without ASLR support or with DEP-incompatible code fail) — test them in the lab before enforcing in production, and document per-application exceptions (Set-ProcessMitigation -Name app.exe -Disable DEP). The system-level command only covers base mitigations: specific ones (CFG, Control Flow Guard) require per-application policy or compilation with support. And note: mitigations hinder exploitation, not eliminate it — modern exploits (ROP, JIT spraying) partially bypass them; detection and the rest of hardening are still necessary.