Hello UWinPC users, today we will learn about some new updates from Microsoft which is related to 24H2. Microsoft’s new enum document mentions the updated Windows 11 24H2, which means it has been confirmed. This new Microsoft has announced that in the upcoming Windows 11 version 24H2 release, expected in late 2023, it was to be a change to how the EnumDeviceDrivers function works when called by programs or users on the system. Specifically, there will now be a new privilege requirement to receive full action results from EnumDeviceDrivers after this 24H2.

Microsoft Mention Update Windows 11 24H2

The EnumDeviceDrivers function is used to enumerate or list all the device drivers currently loaded into the Windows kernel and important information about them including their ImageBase which is the main memory address where each driver image is mapped into the system RAM. goes. It allows analyzing the memory to identify various drivers and debug problems.

Microsoft New Enum Documentation Mention Update Windows 11 Version 24H2
Microsoft New Enum Documentation Mention Update Windows 11 Version 24H2
If we put it in simple terms, starting with 24H2, if you want to get valid, real ImageBase addresses for drivers from function calls to EnumDeviceDrivers, the calling program or user account will now need to explicitly enable “SeDebugPrivilege“.
SeDebugPrivilege is an elevated Windows permission primarily used for debugging and tracing programs that enable deeper system access and inspection. Without activating this permission privilege when calling the function, EnumDeviceDrivers will still run and enumerate the loaded driver list on 24H2 and later versions of Windows 11, but the ImageBase values returned by it will all point to actual usable addresses. Instead of pointing, there will only be NULLs. Driver in memory.

So in practice from 24H2 onwards, any software or tools that call EnumDeviceDrivers to analyze drivers by inspecting their memory locations will either need the elevated SeDebugPrivilege set already – or they will need to run Windows without memory addresses. After Windows 11 24H2 only a less useful list will be returned of the locations where the drivers actually reside in RAM while running.

Enum Documentation Mention Update Windows 11 Version 24H2
Enum Documentation Mention Update Windows 11 Version 24H2

This change is probably being made in Windows 11 version 24H2 release for security reasons – to restrict providing the memory addresses of loaded drivers to non-privileged programs or users, as low-level memory is known about the system. Information can sometimes be exploited. However appropriately privileged debugger tools and utilities should be able to fully take advantage of EnumDeviceDrivers on 24H2 by claiming SeDebugPrivilege rights before calling the function.

Windows 11 Version 24H2 Aspects Features

That means it has become clear from this new enum document. We will start seeing its updates as soon as possible. Because of advanced debugging, software that takes advantage of this function may require an update to request or confirm that it will be enabled and set up to function properly after the 24H2 update lands. If in this new version, we can see updates on AI Copilot, File Explorer, Driver related updates i.e. overall updates seen in the H2 version. Related to this we have Windows 11 24H2 Update: What Aspects Do You See? It has been explained in detail, so you can get all the information by clicking on this link. If you have any query related to this then please leave it in the comment section.


Discover more from UwinPC: Microsoft Windows, AI, Fixes & Updates

Subscribe to get the latest posts sent to your email.

By Akhil Singh

Akhil Singh is the Owner & Editor-in-chief of "uwinpc.com". He graduated in the Computer field. During this period my interest in Microsoft Windows & computers increased. This led to the development of this webpage.

"Unlock Your Windows Secrets with UwinPC"