Windows Exploit Protection profiles¶

Exploit Protection is a separate hardening boundary for process and memory mitigations. It does not configure antivirus, exclusions, firewall policy, SmartScreen, or application control.

Inspect before applying¶

The human-readable plan needs no elevation:

powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\Set-ExploitProtectionState.ps1 -Mode Plan

Testing and mutation through the workstation module use Windows sudo:

.\Apply-Workstation.ps1 -Mode Test -Module ExploitProtection -Plan
.\Apply-Workstation.ps1 -Mode Test -Module ExploitProtection
.\Apply-Workstation.ps1 -Mode Ensure -Module ExploitProtection

Add -Json to the focused script for machine-readable Plan, Test, Ensure, or Reinitialize output. Existing processes retain their process policy; restart affected applications after a change. Windows is never restarted automatically.

Plan validates the declaration, supported action names, and captured artifact without reading live mitigation state. Test performs one live system-policy read and no writes. Both human and JSON output are rendered from the same result object. SchemaVersion 1 includes Mode, Profile, Outcome, Compliant, DriftCount, CapturedPolicy, Controls, Enable, Disable, Changes, SnapshotPath, and ProcessRestartRequired.

DSL and captured default¶

config/exploit-protection.psd1 declares two independently selectable profiles:

Profile	Purpose
`CapturedDefault`	Restore the managed controls to their state before this resource changed the host
`Recommended`	Preserve that baseline while changing system SEHOP from telemetry-only to enforcement

The complete pre-change export, including system and per-program IFEO settings, is config/exploit-protection-captured-default.xml. Its SHA-256, capture time, and Windows build are pinned in the DSL. Every mode verifies the hash before it proceeds. The resource manages only the declared system controls and does not delete or replace per-program entries installed by Windows or application vendors.

Use the default Recommended profile through the orchestrator. The explicit human rollback is:

sudo powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\Set-ExploitProtectionState.ps1 `
    -Mode Ensure -Profile CapturedDefault

Return to the recommendation with:

sudo powershell -NoProfile -ExecutionPolicy Bypass -File .\scripts\Set-ExploitProtectionState.ps1 `
    -Mode Ensure -Profile Recommended

Reinitialize first exports the complete observed policy under state/exploit-protection-snapshots/, then converges to the selected profile.

Managed and observed state¶

Both profiles retain DEP, ATL thunk emulation, bottom-up ASLR, high-entropy ASLR, SEHOP, and heap corruption termination. The sole recommended change is SEHOPTelemetry=OFF.

Mandatory ASLR, reject-stripped-images, strict CFG, strict handle validation, arbitrary code guard, Win32k lockdown, extension-point lockdown, and system user-shadow-stack policy remain observation only. These controls have material compatibility costs and should be introduced later as tested, exact-path application profiles rather than global switches. Legacy EAF, IAF, CallerCheck, SimExec, and StackPivot controls are intentionally not adopted.

The captured per-program policy remains attributable evidence, not a frozen application policy. Windows and application updates may add or adjust per-program entries without being removed by this resource.

Synthetic verification¶

The focused suite substitutes synthetic policies behind a private command adapter. It verifies Plan/Test non-mutation, exact profile delta, action dispatch, idempotence, readback, rollback, and snapshot-before-write ordering without inspecting or changing the host:

powershell -NoProfile -ExecutionPolicy Bypass -File .\tests\Test-ExploitProtectionState.ps1 -Section All
pwsh -NoProfile -File .\tests\Test-ExploitProtectionState.ps1 -Section All

See sample outputs for the stable human and structured shapes.

Rollback boundary¶

Switching to CapturedDefault restores every system setting changed by Recommended. It does not erase later Windows or vendor per-program additions. For a broader recovery, use a pre-change XML from state/exploit-protection-snapshots/ and review it before explicitly applying it with Set-ProcessMitigation -PolicyFilePath.