How-To Geek - Protect Your Files From Ransomware

Wynona · 27 Jan 2020

Windows 10 Build 19551

First, I received a How-To Geek email that linked me to this, which I read:
Do You Need Anti-Ransomware Software for Your PC?

Within the article was a link to this, which I also read and followed:

How to Protect Your Files From Ransomware With Windows Defender’s New “Controlled Folder Access”

And now, I can’t do anything. I’m being told “Unauthorized Changes Blocked”! Anybody know what I might have done wrong?

I think I can go back and undo what I did . . . I think!

bobkn · 27 Jan 2020

I have no intention of playing with it, but I hope that turning off "Controlled Folder Access" will cancel (or at least render inoperative) any other changes that you might have made.

For me, ransomware protection = backup. I haven't gotten around to obliterating OneDrive yet.

The Pool Man · 27 Jan 2020

Wynona -- I knowyna where you're coming from. I did this too. It may have even been the same article that inspired me. This solution is like hiding your car keys from your kid so well you can't find the keys either.

Yes, all you have to do is undo the instructions, reboot, and all should return to normal. If not -- I just play a Tech Support Type on TV.

Wynona · 27 Jan 2020

bobkn said:

I have no intention of playing with it, but I hope that turning off "Controlled Folder Access" will cancel (or at least render inoperative) any other changes that you might have made.

For me, ransomware protection = backup. I haven't gotten around to obliterating OneDrive yet.

Hi, Bob.

According to the How-To Geek article, this would keep ransomware from getting to my data drive, which is separate from my OS drive.

I thought because it's from How-To Geek, it should work, but nope! I'm still not sure I didn't do something wrong.

The good news is that I tried it on my Insider Preview Build 19551 first, so all I have to do is a reinstall if I can't go back.

f14tomcat · 27 Jan 2020

Wynona said:

Hi, Bob.

According to the How-To Geek article, this would keep ransomware from getting to my data drive, which is separate from my OS drive.

I thought because it's from How-To Geek, it should work, but nope! I'm still not sure I didn't do something wrong.

The good news is that I tried it on my Insider Preview Build 19551 first, so all I have to do is a reinstall if I can't go back.

Restore from your Macrium backup.

Wynona · 27 Jan 2020

f14tomcat said:

Restore from your Macrium backup.

Whoops! I did it yesterday and a full backup was done this morning, TC!

I got it fixed, though. All I had to do was turn Controlled Folder Access off!

Problem solved! I think!

Wynona · 27 Jan 2020

Problem solved.

I just had to go back in and turn off Controlled Folder Access. Now, I'm wondering if it was that simple for me, why wouldn't it be the same for Ransomware Hackers?

I'm not going to mark this solved until I'm completely sure things are OK again.

Wynona · 27 Jan 2020

bobkn said:

I have no intention of playing with it, but I hope that turning off "Controlled Folder Access" will cancel (or at least render inoperative) any other changes that you might have made.

For me, ransomware protection = backup. I haven't gotten around to obliterating OneDrive yet.

Thank you, Bob. That's all it took!

bobkn · 27 Jan 2020

Wynona said:

Hi, Bob.

According to the How-To Geek article, this would keep ransomware from getting to my data drive, which is separate from my OS drive.

I thought because it's from How-To Geek, it should work, but nope! I'm still not sure I didn't do something wrong.

The good news is that I tried it on my Insider Preview Build 19551 first, so all I have to do is a reinstall if I can't go back.

At a guess, nothing went wrong. Perfect security is achieved when it becomes impossible to do anything.

More seriously, you may have to set a lot of permissions to allow you to change files the way that you wish to. That may defeat the purpose of turning on that switch in the first place. (Do you suppose that there may be a reason that switch isn't turned on by default?

)

Speaking with a former co-worker, my previous employer seems to be moving in the direction of having all data and applications resident on servers. No local data, no local processing. The 1980s are making a comeback: dumb terminals connected to remote computers (in effect). Glad I don't have to deal with that IT department any more.

Bree · 27 Jan 2020

Wynona said:

And now, I can’t do anything. I’m being told “Unauthorized Changes Blocked”!
...I think I can go back and undo what I did . . . I think!

bobkn said:

I have no intention of playing with it...

I 'played with it' from the moment it was first included in version 1803. I leave Controlled Folder Access turned on for all my machines find it completely unobtrusive.

The trick is to allow your preferred apps access. Many (such as MS Office) will automatically be allowed access, but some (mainly 3rd-party apps) will not. While the protection side of the ransomware protection has changed little since 1803, in the beginning it was almost impossible to determine what had been blocked. You had to go into event viewer just to find the path and name of any blocked executable that needed to be granted access.

With each new version since then the reporting of which apps to grant access has improved. Now in 1903/1909 you just need to open Windows Security's ransomware protection, click on 'Add an allowed app' and pick from a list of recently blocked apps.

I have about half a dozen apps in my 'allowed' list now, and I can't remember the last time I was blocked from doing anything. Once your apps are on the 'allowed' list you won't notice the protection in action.

Add or Remove Allowed Apps for Controlled Folder Access in Windows 10