How to fix vulnerability "Windows Speculative Execution Configuration Check" on Windows Server Operating System

Tushar Sudhakar Bhurke TPR (IN) 20 Reputation points
2026-10-27T08:18:28.7433333+00:00

How to fix vulnerability "Windows Speculative Execution Configuration Check" on Windows Server Operating System.

Windows for business | Windows Server | User experience | Other
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Daphne Huynh (WICLOUD CORPORATION) 2,540 Reputation points Microsoft External Staff Moderator
    2026-10-27T08:29:28.1566667+00:00

    Welcome to Microsoft Q&A!

    Based on your descriptions, I understand your concern about seeing the "Windows Speculative Execution Configuration Check" vulnerability reported on your Windows Server. Even when the server is fully updated through Windows Update, this finding may still appear because protection against speculative-execution vulnerabilities can involve additional configuration beyond installing Windows security updates.

    These vulnerabilities relate to processor speculative execution and may require a combination of the appropriate Windows security updates, hardware/firmware support, and Windows mitigation settings. Please also notes that some additional mitigations must be enabled manually and may have a performance impact.

    I recommend following Microsoft's KB4072698 guidance for the specific speculative-execution vulnerabilities reported by your vulnerability scanner, rather than applying a generic registry value taken from another environment.

    First, make sure the Windows Server operating system is fully up to date and that the applicable firmware/microcode updates provided by the server or processor manufacturer have been installed.

    Then, follow KB4072698 to verify the current protection status by using the SpeculationControl PowerShell module. This is a specifically recommendation this method for confirming whether the required protections are enabled.

    If the required protections are not enabled, follow the corresponding KB4072698 instructions to enable the applicable mitigation through the Session Manager registry configuration.

    The relevant configuration is under:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

    Depending on the mitigation required, this may involve values such as:

    FeatureSettingsOverride
FeatureSettingsOverrideMask

    It is important not to apply a generic FeatureSettingsOverride value solely based on the scanner finding, because the required mitigation depends on the specific speculative-execution vulnerability and system configuration. Use the value documented in KB4072698 for the applicable protection instead.

    After applying the required configuration, restart the server, as Microsoft documents that a reboot is required for these protections to take effect.

    After the restart, run Get-SpeculationControlSettings again and confirm that the protections applicable to the vulnerability are enabled. Microsoft specifically points to the output of this tool for validating protection against these vulnerabilities.

    Once Windows reports the required protections as enabled, run the vulnerability scan again. If the Windows mitigation is shown as enabled but the scanner continues to report "Windows Speculative Execution Configuration Check," compare the CVE identified by the scanner with the mitigation status reported by Get-SpeculationControlSettings. This will help distinguish a remaining Windows/firmware mitigation requirement from the scanner's compliance detection.

    Please also keep in mind that manually enabling these additional mitigations may affect performance, so the impact should be evaluated when making the change on production servers

    Reference:

    Guidance for mitigating silicon based micro-architectural and speculative execution side-channel vulnerabilities - Azure Virtual Machines | Microsoft Learn

    If you find it useful, please click Accept Answer.

    Thank you for choosing Microsoft Q&A.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-10-27T08:19:16.2733333+00:00

    Install all current Windows security updates and the server vendor’s latest BIOS/firmware microcode, then use Get-SpeculationControlSettings to identify and enable only the mitigations that remain disabled.

    1. Update Windows and the server firmware

    Microsoft’s complete protection requires both software and, for some processor vulnerabilities, firmware/microcode support ^1^.

    1. Install all applicable monthly Windows security updates.
    2. Install the latest BIOS/UEFI or firmware package supplied for that server model.
    3. Restart Windows.
    4. If this is a virtual machine, ensure the virtualization host has also received the required firmware/microcode and operating-system updates.

    Do not copy a generic scanner-supplied registry value before identifying the affected CVE and processor type. The correct value differs for Intel and AMD processors and when several mitigations must coexist.

    2. Check the actual mitigation status

    On Windows Server 2016 or a server with Windows Management Framework 5.0/5.1, open PowerShell as Administrator and run:

    Install-Module SpeculationControl

$SavedPolicy = Get-ExecutionPolicy
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
Import-Module SpeculationControl
Get-SpeculationControlSettings
Set-ExecutionPolicy $SavedPolicy -Scope CurrentUser

    The command reports hardware support, Windows support, policy state, and whether each mitigation is enabled. Enabled protections appear as True ^2^.

    Interpret important failures as follows:

    • Hardware support … present: False — update the physical host’s OEM firmware/microcode. In a guest VM, the host must expose that support.
    • Windows OS support … present: False — required Windows updates are missing.
    • Disabled by system policy: True — the mitigation is disabled through the FeatureSettingsOverride registry policy.
    • Support present but enabled: False — consult the matching CVE section in KB4072698; some Windows Server protections require explicit registry enablement.

    3. Enable the mitigation identified by the check

    For the commonly reported combination of CVE-2018-3639, CVE-2017-5715, and CVE-2017-5754, Microsoft documents these server settings ^1^:

    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 8 /f
reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

    Restart the server afterward.

    Important: changing these values overwrites the existing mitigation bitmask. Before doing so, record the current values:

    reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride
reg query "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask

    If other mitigations are already configured—such as Intel Branch History Injection, AMD Branch Type Confusion, MMIO, MDS, or L1TF—use the Enabling multiple mitigations table in KB4072698 and combine the required values. Do not replace a combined value with 8.

    AMD-specific protections also have different documented values; first verify the CPU vendor and the exact failed CVE.

    4. Hyper-V hosts

    If the Hyper-V feature is installed, add:

    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f

    After host firmware is updated:

    1. Fully shut down—not merely restart—all guest VMs.
    2. Restart the Hyper-V host.
    3. Start the VMs again so they receive the firmware-related mitigation exposure.

    5. Validate remediation

    After the restart:

    1. Run Get-SpeculationControlSettings again.
    2. Confirm that the relevant hardware support, Windows support, and enabled fields report True.
    3. Rescan the server with the vulnerability scanner.

    Some mitigations can affect performance, so test registry changes on a representative non-production server before broad deployment. If the scanner still reports the generic finding, compare its failed check or CVE with the PowerShell output; the scanner title alone does not identify which mitigation is missing.

    References

    1. KB4072698: Windows Server and Azure Stack HCI guidance to protect against silicon-based microarchitectural and speculative execution side-channel vulnerabilities | Microsoft Support
    2. KB4074629: Understanding SpeculationControl PowerShell script output | Microsoft Support
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.