When setting with nLite DEP to always off (/noexecute=alwaysoff) previous default entry on the same line doesn't get deleted and stays (/noexecute=optin) before /fastdetect, so there's double /noexecute entry in boot.ini on the same line. Entry set/added at the end of the line by nLite seems to take effect, so it's mainly a cosmetic issue (one has to delete 1 /noexecute entry in boot.ini manually).

Edited November 7, 200619 yr by tsk

It has been reported several times. Seems like a MS' issue. nLite modifies winnt.sif correctly (I think), maybe there could be also modified something else to disable writing /noexecute=optin automatically, but I don't know...

I would say, that DEP is enabled, unless that line is removed manually.

Edited November 8, 200619 yr by TheTOM_SK

> I would say, that DEP is enabled, unless that line is removed manually.

You are right most likely. My own observations: after manually removing /noexecute=optin and rebooting (now only /noexecute=alwaysoff is left), Process Explorer shows that DEP is disabled for all processes except "System". DEP dialog in system properties looks different now - no dot in both radio buttons there and whole dialog is disabled (haven't checked with PE before, but there was a dot in 1 radio button on DEP dialog before the manual change. So DEP was probably ON for MS OS binaries before). So it's not so cosmetic bug - it actually affects DEP status.

When I have some time, I'll re-add /noexecute=optin in boot.ini (in the same place), reboot, and re-check DEP status for processes in PE.

Edited November 8, 200619 yr by tsk

bump

bug still there