Description:

Controlled Folder Access is the ransomware protection feature of Microsoft Defender Antivirus in Windows Security. It stops untrusted or suspicious apps from changing, encrypting or deleting files in protected folders such as Documents, Pictures, Videos, Music, Favorites and Desktop. Only apps that Microsoft trusts, or that an administrator allows, can write to these folders. 


Rationale:

  • Protects important files from ransomware encryption and tampering

  • Blocks malware and unknown apps from changing files in protected folders

  • Logs every blocked attempt for security monitoring and investigation

  • Supports compliance requirements for malware protection and data integrity (ISO 27001, SOC 2, CIS Benchmarks)


Impact:

  • Adds a strong layer of protection against ransomware with no change to normal user work

  • Some legitimate apps (for example older or in-house tools) may be blocked from saving files to protected folders

  • Blocked apps must be reviewed and added to the allowed apps list when needed

  • Users will see a notification each time an app is blocked


Default Value:

Controlled Folder Access is turned off by default on Windows 10 and Windows 11. If the setting is greyed out with "This setting is managed by your administrator", it's controlled by Intune or Group Policy and must be changed there.


Pre-requisites:

  • Local Administrator rights

  • Windows 10 (version 1709 or later) or Windows 11

  • Microsoft Defender Antivirus as the active antivirus, with real-time protection turned on

  • A list of business apps that need to save files to protected folders (to add to the allowed apps list)

  • No Intune or Group Policy setting that overrides Controlled Folder Access on the device


Test Plan:

UI:

  1. Click Start, search for Settings, and open it (or press Windows + I).

  2. In the left pane, click Privacy & security.

  3. Under Security, click Windows Security.

  4. Click Virus & threat protection.

  5. Scroll down to Ransomware protection and click Manage ransomware protection.

  6. Confirm that Controlled folder access is On.

  1. If it is Off, follow the Implementation Plan.


PowerShell

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Run the below cmd to check 

              (Get-MpPreference).EnableControlledFolderAccess 


  1. Expected result: AMServiceEnabled and RealTimeProtectionEnabled are True, and EnableControlledFolderAccess is 1 (Enabled). A value of 0 means Disabled and 2 means Audit mode. If it isn't 1, follow the Implementation Plan.


Implementation Plan

UI

  1. Click Start, search for Settings and open it (or press Windows + I).

  2. In the left pane, click Privacy & security and select Click Virus & threat protection.


  1. Scroll down to Ransomware protection and click Manage ransomware protection.

  2. Turn the Controlled folder access toggle On.

  3. Click Yes on the User Account Control prompt.

  1. (Optional) Click Protected folders → Add a protected folder to protect other folders that hold important data.

  2. (Optional) Click Allow an app through Controlled folder access → Add an allowed app to allow trusted business apps that are being blocked.

  3. Confirm that Controlled folder access now shows On.


PowerShell

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Turn on Controlled Folder Access:

             Set-MpPreference -EnableControlledFolderAccess Enabled

             

            


  1.  (Optional) Add another folder to protect (change the path to your folder):

  Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\CompanyData"

  1. (Optional) Allow a trusted app that needs to save files to protected folders (change the path to your app):

  Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\AppName\App.exe"

  1. Confirm the setting. EnableControlledFolderAccess should be 1:

  Get-MpPreference | Select-Object EnableControlledFolderAccess, ControlledFolderAccessProtectedFolders, ControlledFolderAccessAllowedApplications

  1. (Optional) View apps that have been blocked (Event ID 1123):

  Get-WinEvent -LogName "Microsoft-Windows-Windows Defender/Operational" | Where-Object Id -eq 1123 | Select-Object TimeCreated, Message -First 


Backout Plan

UI

  1. Click Start, search for Settings and open it (or press Windows + I).

  2. In the left pane, click Privacy & security.

  3. Under Security, click Windows Security → Virus & threat protection.

  4. Under Ransomware protection, click Manage ransomware protection.

  5. Turn the Controlled folder access toggle Off and click Yes on the User Account Control prompt.

  6. If only one app is being blocked, add it under Allow an app through Controlled folder access instead of turning the feature off.


PowerShell:

  1. Click Start and search for PowerShell.

  2. Right-click Windows PowerShell and select Run as administrator.

  3. Click Yes on the User Account Control prompt. The prompt shows   and the window title starts with Administrator:.

  4. Turn off Controlled Folder Access:

 Set-MpPreference -EnableControlledFolderAccess Disabled

  1. Or switch to Audit mode, which logs what would be blocked without blocking it:

Set-MpPreference -EnableControlledFolderAccess AuditMode

  1. Confirm the setting. EnableControlledFolderAccess should be 0 (Disabled) or 2 (Audit mode):

Get-MpPreference | Select-Object EnableControlledFolderAccess

Reference: