DEP on everything - seamless or not so seamless?

Simply what I'm wondering, since I'm trying methods to harden a system without being too troublesome, is if tasks like installing and using software, etc. is not so seamless when having DEP on EVERYTHING. For example... let's say that I've just reinstalled my system, and I want to install Opera again. With DEP for everything, where this installation would obviously be included, and more importantly IE which I've to download it through - can I just install like normal, and in general with all the other common software like defragment tools, AM programs, using Seconfig XP for example, etc. etc.?

OR, do I have to add every single thing that I want to install and use into exceptions? Is it like working with a default-deny approach?

 

i have DEP for everything and its never bothered me, ive had to make only 1 exclusion ever with it, ive had the occassional explorer.exe get terminated by it but it only happens rarely and explorer.exe just restarts itself.

 

Okay, thanks - so you're running with it for everything full-time?

Waiting for more input before I'm completely sure about a decision.

 

Hello Raven

I'm running it for everything and have never faced any dialogue boxes or installation hiccups - which does make me wonder whether I should be...?

philby

 

Yeah, that's a good question... Does somebody know if a lot is simply happening "behind the scenes"?

 

This might shed a little light - I'm running it as it would seem to be an advisable way to harden, but have to confess I'm not really sure about what happens under the hood...

philby

 

Haha - maybe I should go under the impression "better than nothing".


EDIT: Oh right... another thought passed my mind... does enabling for everything have any impact on the system (performance, browsing speeds, etc.)?

 

It should at least guarantee that nobody ever 'overruns your buffer'... and that can only be a good thing...

Re. your Edit: No performance hit whatsoever here.

philby

 

Thanks, philby.

 

I had been testing with DEP-on-everything a few months back without any problems but it did warn a few times when I ran some odd software that used a specific packer that intentionally executed code in a way that triggered DEP.

It's probably quite rare but if you do see some new program not work properly or trigger a DEP warning, you may want to lower the protection temporarily.

 

I added a 3rd party defrag tool as it doesn't work unless added. And imaging/backup tools, just incase. I haven't really noticed anything else not functioning.

 

Yeah, I'll try my MyDefrag to see how it likes it.

 

Ran the gui version (mydefrag.net) last night - Vista was silent on the matter... but then nothing was installed.

philby

 

I have hardware-based DEP enabled for everything on a Windows Vista Business workstation, and all works well. One exception was a prior edition of ShadowProtect Desktop, but the current version (3.3 or 3.4) is DEP compatible.

 

yep, full time, every program (except this one game i have but no biggy since i just exclude it) no performance impact, and if for no other reason, use it just because its better to be safe than sorry.

 

Great post, thank you firzen.

 

dang u reply quick

hmm then again it seems i do too

 

Hehe - well, what can I say? When I'm active in the forums - I'm active.

 

haha ye i seem to be the same way...

 

I've never even given this any thought before, and I have just checked to find I have DEP turned ON within my Windows XP system. I've never noticed anything happen and have expected things like installations to run as they should. However, my processor doesn't support hardware-based DEP.

 

Hello,
i sometimes get problems with DEP always on.
strangely the program that causes DEP to stop the program works fine most of the time.
so your milage may vary.
you can always change the option back if it causes issues.

 

True.

Have you tested to exclude the program which got problems?

 

With full DEP, I get error-messages (buffer overflow messages) on Google Talk - even when excluding it! What's up with that?

 

hmm no idea, never used google talk

 

To add some information, it's when it's sending a direct-link to the default browser, which in my case is Opera. (When clicking to show a new mail that's received for example.) As I'm brainstorming now, my guess would be that I've add an exception of Opera in my case as well and it might not throw up that message. Question is if it's safe to add my web-browser as an exception. Doesn't sound too safe to me, even if it's ofc better than nothing - I'm not sure.