Virtualization Enable or Disable Clear Virtual Memory Paging File at Shutdown in Windows 11


  • Staff
Virtual_Memory_banner.png

This tutorial will show you how to enable or disable clear virtual memory paging file at shutdown or restart for all users in Windows 10 and Windows 11.

A paging file (aka: "page file" and "virtual memory") enables the system to remove infrequently accessed modified data from physical memory to let the system use physical memory more efficiently for more frequently accessed data. Windows also uses the page file to store data when physical memory (RAM) is full.

The Shutdown: Clear virtual memory pagefile policy setting determines whether the virtual memory paging file is cleared when the device is shut down or restarted. Virtual memory support uses a system paging file to swap pages of memory to disk when they aren't used. On a running device, this paging file is opened exclusively by the operating system, and it's well protected. However, devices that are configured to allow other operating systems to start should verify that the system paging file is cleared as the device shuts down. This confirmation ensures that sensitive information from process memory that might be placed in the paging file isn't available to an unauthorized user who manages to directly access the paging file after shutdown.

Important information that is kept in real memory might be written periodically to the paging file. This periodical write-operation helps devices handle multitasking functions. A malicious user who has physical access to a server that has been shut down can view the contents of the paging file. The attacker can move the system volume into a different computer and then analyze the contents of the paging file. This process is a time-consuming one, but it can expose data that is cached from RAM to the paging file. A malicious user who has physical access to the server can bypass this countermeasure by unplugging the server from its power source.

Enabling the Shutdown: Clear virtual memory pagefile policy causes the amount of time that is required to complete a shut down or restart depends on the size of the page file. It takes longer to shut down and restart the device, especially on devices with large paging files. Because the process overwrites the storage area that is used by the page file several times, it could be several minutes before the device completely shuts down or restarts.

Reference:


You must be signed in as an administrator to enable or disable the Shutdown: Clear virtual memory pagefile policy.



Contents

  • Option One: Enable or Disable Clear Virtual Memory Paging File at Shutdown in Local Security Policy
  • Option Two: Enable or Disable Clear Virtual Memory Paging File at Shutdown using REG file




Option One

Enable or Disable Clear Virtual Memory Paging File at Shutdown in Local Security Policy


Local Security Policy is only available in the Windows 10/11 Pro, Enterprise, and Education editions.

All editions can use Option Two to configure the same policy.


1 Open Local Security Policy (secpol.msc).

2 Click/tap to open Local Policies and Security Options in the left pane of Local Security Policy. (see screenshot below step 3)

3 In the right pane of Security Options, double click/tap on the Shutdown: Clear virtual memory pagefile policy to open its properties. (see screenshot below)

Clear_virtual_memory_pagefile_at_shutdown_secpol-1.png

4 Select (dot) Enabled or Disabled (default) for what you want, and click/tap on OK. (see screenshot below)

Clear_virtual_memory_pagefile_at_shutdown_secpol-2.png

5 You can now close Local Security Policy if you like.




Option Two

Enable or Disable Clear Virtual Memory Paging File at Shutdown using REG file


1 Do step 2 (enable) or step 3 (disable) below for what you would like to do.

2 Enable Clear Virtual Memory Paging File at Shutdown

A) Click/tap on the Download button below to download the file below, and go to step 4 below.​

Enable_Clear_virtual_memory_paging_file_at_Shutdown.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"ClearPageFileAtShutdown"=dword:00000001

3 Disable Clear Virtual Memory Paging File at Shutdown

This is the default setting.


A) Click/tap on the Download button below to download the file below, and go to step 4 below.​

Disable_Clear_virtual_memory_paging_file_at_Shutdown.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management]
"ClearPageFileAtShutdown"=dword:00000000

4 Save the REG file to your desktop.

5 Double click/tap on the downloaded REG file to merge it.

6 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

7 You can now delete the downloaded REG file if you like.


That's it,
Shawn Brink


 

Attachments

  • Virtual_Memory.png
    Virtual_Memory.png
    6.4 KB · Views: 80
  • Disable_Clear_virtual_memory_paging_file_at_Shutdown.reg
    728 bytes · Views: 186
  • Enable_Clear_virtual_memory_paging_file_at_Shutdown.reg
    732 bytes · Views: 206
Last edited:
Back
Top Bottom