Windows Defender Update - Kernel-mode Hardware-enforced Stack Connection vs BattlEye

[KamikazeHamster]

Howdy all, had trouble logging in tonight and just worked out why so thought I would share.

CONAN EXILES WOULD NOT LAUNCH AFTER WINDOWS DEFENDER UPDATE ACTIVATED

When I turned PC on tonight, Windows Defender had a little exclamation mark requiring attention, seems like a new Windows Update - hooray for frickin Windows…

I nonchallantly trusted this would make life better (what the hell was I thinking?!?!) and turned it on as recommended. All good (?).

Tried to launch Conan Exiles as I had grinding to do, Crom-damnit.

Launcher opened, I hit “LAUNCH” and it thought for a bit then went “nah, CBF, soz not soz” and closed.

Tried again but with “CONTINUE” button. Same thing.

Tried over and over, verified integrity, no issues, rebooted, no diff, turned BattlEye off and it suddently worked. But I could not log into servers as BattleEye was off. Reinstalled BattleEye and turned it on, tried launcher again. It did the “I have better things to do, F&^% off” thing again - just kept closing without launching game.

“30 minits later…”

I then recalled the Windows Defender thing I did and eventually found this:
https://www.elevenforum.com/t/kernel-mode-hardware-enforced-stack-protection-suddenly-off.14250/

I opened Windows Defender, then Device Security then Core Isolation Details to get back to this screen

, and turned “Kernel-mode blkah blah f*&^ing blah” off again (mind you, it would not actually switch off, it slid back on again immediately every time I did it, very glitchy, but then when I closed the screen, the exclamation mark was whining at me again and I opened that screen back up and it was indeed showing as “off.”

Voila, all working again.

[SirDaveWolf]

BattleEye is partially running in Kernel Mode (as a Windows driver, in order to hook processes at a lower level).

Looks like it is not compatible with this security measure from Windows defender.

I also have this turned off (Sorry for German Windows):

[FeyWarrior]

Yes, sadly I too can confirm, this new security feature is not currently compatible with BattleEye.

According to BattleEye they did say they “working on finding a solution and are also in contact with Microsoft regarding this issue, unfortunately there is no easy or immediate fix for it.”
BattleEye FAQ

Could some moderator please sticky this post or repost this information as it’s likely to impact a lot of players running Windows 11?

[Cattibria]

Just to add this to the conversation.

If you are not using Windows Defender and have a third-party security application installed, you are not affected by this issue.

[Taemien]

If your server doesn’t need it. You can uninstall BatteEye as well:

BattlEye – The Anti-Cheat Gold Standard » FAQ.

For Conan Exiles this location is \Conan Exiles\ConanSandbox\Binaries\Win64\BattlEye

[FeyWarrior]

@Cattibria I believe you may be right for Windows 10 users.

Windows 11 has pre-installed Windows Defender whose settings are accessible under Windows Security > Virus and threat protection. Turning that on or off however won’t fix the BattleEye issue for Windows 11 users on the latest release.

As I’m using a third party anti-virus I don’t even have the option to disable anything here as Windows 11 has automatically disabled the built-in anti-virus (aka Windows Defender) anyway.

Instead as the OP @KamikazeHamster flagged we need to go to Windows Security > Device Security > Core Isolation to turn off Kernal-mode Hardware-enforced Stack Protection to fix the BattleEye issue.

I’m not sure if it’s different for Windows 10 users but on my work laptop (Windows 10 Professional Version 21H1 OS build 19043.1826) the Kernal-mode Hardware-enforced Stack Protection doesn’t seem to exist as an option under the Core Isolation section of Device Security, so I presume it’s not an issue?

[Kapoteeni]

Another article describing the Defender update. Apparently it affects quite a few games that use some sort of anti-cheat:

Microsoft Defender update causes Windows Hardware Stack Protection mess

(Bleepingcomputer is often quoted by national cyber security agencies, so they tend to be a reliable source of information.)

[Cattibria]

@FeyWarrior

Windows 11 has pre-installed Windows Defender whose settings are accessible under Windows Security > Virus and threat protection.

To avoid anti-trust litigation, when Microsoft bought a security software company, they agreed that a third-party security application, when installed, that provides the same functionality as Windows Defender will disable Windows Defender as part of the installation process. This applies to all versions of Windows since Microsoft started including security software as part of the OS.