How To Enable Control Flow Guard: Windows Security Feature Activation

I remember the first time I enabled Control Flow Guard on a test machine back in the Windows 10 days. This built-in feature stops memory corruption attacks cold, and it’s easier to activate than you’d think.

You’ll need a 64-bit Windows version and admin rights. The process takes under 5 minutes through Group Policy or a simple command. No special tools, just the right clicks in the right places.

Once enabled, your system gains a critical layer of protection against exploits. I’ve watched it block attacks that would’ve compromised unprotected systems, all without noticeable performance impact.

Works on Windows 10 and 11, with verification steps to confirm it’s running. Let’s lock it down.

What Youll Need

Instructions

Here is the process I use to enable this protection feature on any Windows system.

First, confirm your system runs Windows 10 version 1703 or later. Earlier builds lack the necessary infrastructure. I always check by pressing Win + R, typing winver, and verifying the version number matches or exceeds 1703.

Ensure your applications are compiled with /guard:cf flag support. Without this, Control Flow Guard cannot protect them. Most modern Microsoft applications and many third-party tools already include this flag, but legacy software may not.

Press Win + R, type gpedit.msc, and press Enter to open the Local Group Policy Editor. Navigate to Computer Configuration, then Administrative Templates, followed by System, and finally Control Flow Guard.

Double-click Enable Control Flow Guard and select Enabled. Click Apply, then OK. This activates the feature system-wide. If you are on Windows Home, which lacks Group Policy Editor, proceed to the registry method in the next step.

Press Win + R, type regedit, and press Enter to open the Registry Editor. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel. If the Kernel key does not exist, right-click Session Manager, select New, then Key, and name it Kernel.

Right-click in the right pane, select New, then DWORD (32-bit) Value. Name it EnableUltraGuard. Double-click the new value, set it to 1, and click OK. Close the Registry Editor and restart your computer for changes to take effect.

After rebooting, open Command Prompt as administrator and run Get-WindowsOptionalFeature -Online -FeatureName Guard. Look for ControlFlowGuard in the output. If the State column shows Enabled, the feature is active.

For additional verification, use the Process Explorer tool from Sysinternals. Launch it, locate a protected process like explorer.exe, right-click, and select Properties. Under the Image tab, check for Control Flow Guard in the list of enabled features.

Tips and Common Mistakes

These practical insights will help you avoid common pitfalls when activating this security feature.

Version Verification: In Step 1, don’t skip the winver check. I’ve seen users assume their Windows 10 installation is current, only to discover they’re running an older build that lacks Control Flow Guard support. The version must be 1703 or higher—this is non-negotiable.

Group Policy Limitation: Remember that Windows Home edition doesn’t include Group Policy Editor. If you hit this wall in Step 2, don’t waste time searching for workarounds. The registry method in Step 3 works just as well and is your only option on Home edition.

Registry Precision: When creating the EnableUltraGuard value in Step 3, ensure it’s exactly a DWORD (32-bit) Value. I once created a QWORD by mistake, and the feature wouldn’t activate until I corrected it. Also, the value must be set to 1—not 0, not true, but precisely 1.

Verification Tip: In Step 4, if ControlFlowGuard doesn’t appear in the output, don’t panic. Try running the command again after a full system restart. Sometimes the feature needs that extra reboot to fully initialize, especially if you used the registry method.

Frequently Asked Questions

Enabling Control Flow Guard (CFG) is a straightforward yet powerful way to enhance your Windows system’s security against exploits. 🔒 By following the steps outlined, you’ve taken a proactive step to safeguard your applications. Next, consider exploring other Windows security features like Arbitrary Code Guard or Exploit Protection to further harden your defenses!