The game you're playing probably has kernel access. So does your VPN. So does TeamViewer. So does that hardware monitoring tool running in your system tray.

Kernel access lets software interact directly with your operating system's core. Performance benefits and advanced functionality come with massive security risks. After CrowdStrike crashed 8.5 million computers, it's worth knowing which applications on your machine have this level of access—and which ones don't need it.

Key Takeaways

• Kernel access allows software to interact directly with your operating system's core—powerful but dangerous.
• Many applications request kernel access without clear necessity: anti-cheat software, VPNs, hardware monitors, remote desktop tools.
• Best practice: limit kernel access to only what's genuinely required, and know what's running with elevated privileges.

Hidden in Plain Sight

The following is a list of applications that may require kernel access.

Best practice is to limit kernel access to only the most necessary applications.

Application	Purpose	Examples
Anti-Cheat Software	Monitors game processes, memory, and hardware to detect low-level cheating	Vanguard, EasyAntiCheat, BattlEye
Security Software	Protects against malware by monitoring system calls and intercepting malicious activities	Antivirus, EDR solutions
Virtualization Software	Manages virtual machines with direct hardware access for near-native performance	VMware, VirtualBox, Hyper-V
Performance Monitoring Tools	Monitors CPU frequencies, temperatures, voltages; enables hardware overclocking	MSI Afterburner, HWiNFO
Remote Access Software	Enhances remote desktop functionality and secure connections	TeamViewer, RealVNC
Backup and Recovery Software	Creates disk images, backs up locked files, performs bare-metal recovery	Acronis, Macrium Reflect
Disk Management Tools	Manipulates partition tables, file systems, and disk structures at low level	EaseUS, MiniTool Partition Wizard
VPN Clients	Bypasses user-mode processing for better throughput and network traffic interception	Some enterprise VPN solutions
Development and Debugging Tools	Inspects kernel memory, sets hardware breakpoints, analyzes system crashes	WinDbg, Sysinternals tools

Identifying Kernel Access Requests

Recognizing when software is requesting kernel-level access is essential for system security:

• Driver Installation Prompts: Windows will display security warnings when installing unsigned or kernel-mode drivers
• UAC Elevation Requests: Frequent or persistent administrator privilege requests, especially during installation
• Digital Signatures: Check if drivers are signed by Microsoft or verified publishers
• Installation Warnings: Antivirus software may flag kernel-mode components during installation
• System Restart Requirements: Many kernel-level components require system restarts to load properly

Mitigation Strategies

When kernel access is unavoidable, implement these protective measures:

• Application Sandboxing: Use Windows Sandbox or virtual machines for untrusted software
• Windows Defender Application Guard: Isolate potentially risky applications
• System Restore Points: Create restore points before installing kernel-level software
• Regular Backups: Maintain current system and data backups
• Staged Deployment: Test kernel-level software on non-critical systems first

User-Mode Alternatives

Consider these alternatives before granting kernel access:

• Application-Level Monitoring: Many monitoring tasks can be performed without kernel access
• Windows Performance Counters: Access system metrics through standard APIs
• User-Mode Network Filters: Use WinSock LSP or WFP for network monitoring
• Managed Security Solutions: Cloud-based security services that reduce local kernel dependencies
• Hardware Abstraction Layers: Use manufacturer-provided APIs instead of direct hardware access

Warning Signs

Be alert to these red flags when evaluating software requesting kernel access:

• Unsigned Drivers: Lack of valid digital signatures from trusted publishers
• Unknown Publishers: Software from unestablished or suspicious developers
• Excessive Permissions: Requests for more access than functionally necessary
• Poor Documentation: Vague explanations for why kernel access is required
• Bundled Software: Kernel components included with unrelated applications
• Emergency Updates: Rushed patches that bypass normal testing procedures

Limit kernel access to software that genuinely requires it. Verify publisher reputation before installing anything that asks for it.