How to Completely Disable ‘Windows Defender Exploit Guard’ via Group Policy in Windows 11

Windows Defender Exploit Guard (specifically the Exploit Protection module) is a robust security feature in Windows 11 designed to mitigate memory corruption vulnerabilities. It automatically applies advanced safeguards—such as Data Execution Prevention (DEP), Address Space Layout Randomization (ASLR), and Control Flow Guard (CFG)—to applications system-wide. While excellent for defending against zero-day exploits, these aggressive memory protections can cause catastrophic failures in legacy enterprise software. Older bespoke applications, specialized industrial control systems, or complex DRM-protected games that rely on precise, hard-coded memory addressing will crash instantly when Exploit Guard attempts to randomize their execution space or intercept their system calls.

This guide explains how to completely disable Windows Defender Exploit Guard (Exploit Protection) via Group Policy in Windows 11, ensuring maximum compatibility for legacy applications that cannot tolerate memory randomization.

Disable Exploit Guard via Group Policy

To enforce a strict block that disables the feature globally across the OS, we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, strictly follow this exact path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Defender Exploit Guard > Exploit Protection

5. In the right-hand pane, locate the policy named Use a common set of exploit protection settings.
6. Double-click the policy to open its configuration window.
7. While you might assume you should select “Disabled,” Exploit Guard actually requires you to deploy a blank XML configuration file to override the default system mitigations. Ensure the policy is set to Enabled.
8. In the Exploit protection XML file location field, input the path to an empty or disabled XML configuration file (e.g., C:\IT\disabled_exploit_guard.xml). (You must generate an XML file using the PowerShell Get-ProcessMitigation cmdlet with all settings explicitly turned off, and place it at this path).
9. Click Apply, then click OK.

Verify the Configuration Lockdown

Because Exploit Guard deeply hooks into the Windows kernel and memory management subsystem, Group Policy changes to this component require a full system reboot to cleanly unload the mitigations.

To enforce the change, open an elevated Command Prompt and execute gpupdate /force, then reboot the workstation. Post-reboot, to verify the restriction is active, open the Windows Security app and navigate to App & browser control > Exploit protection settings. Under both the “System settings” and “Program settings” tabs, you will see that all mitigations (DEP, ASLR, CFG) are either toggled off or greyed out with a message stating, “This setting is managed by your administrator.” The operating system is now stripped of its memory protections, allowing your legacy applications to run without crashing.