Windows 10: Enable or Disable Controlled Folder Access in Windows 10  

    Enable or Disable Controlled Folder Access in Windows 10

    Enable or Disable Controlled Folder Access in Windows 10

    How to Enable or Disable Windows Defender Exploit Guard Controlled Folder Access in Windows 10
    Published by Category: Security System
    19 Jul 2018
    Designer Media Ltd

    Published by


    Brink's Avatar
    Administrator

    Posts: 33,175

    Show Printable Version 


    How to Enable or Disable Windows Defender Exploit Guard Controlled Folder Access in Windows 10


    Starting with Windows 10 build 16232, Controlled folder access is introduced in Windows Defender Antivirus.

    Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard.

    Controlled folder access in Windows Defender Security Center reviews the apps that can make changes to files in protected folders. Occasionally, an app that is safe to use will be identified as harmful. This happens because Microsoft wants to keep you safe and will sometimes err on the side of caution; however, this might interfere with how you normally use your PC. You can add an app to the list of safe or allowed apps to prevent them from being blocked.

    You can add additional folders to the list of protected folders, but you cannot alter the default list, which includes folders such as Documents, Pictures, Movies, and Desktop. Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults.

    For more details about Controlled folder access, see:

    This tutorial will show you how to enable or disable the Controlled folder access feature of Windows Defender Exploit Guard in Windows 10.

    You must be signed in as an administrator to enable or disable Controlled folder access.


     CONTENTS:

    • Option One: Turn On or Off Controlled Folder Access in Windows Defender Security Center
    • Option Two: Turn On or Off Controlled Folder Access in PowerShell
    • Option Three: Enable or Disable Controlled Folder Access in Local Group Policy Editor
    • Option Four: Enable or Disable Controlled Folder Access using a REG file


    EXAMPLE: Windows Defender Exploit Guard Controlled Folder Access








    Enable or Disable Controlled Folder Access in Windows 10 OPTION ONE Enable or Disable Controlled Folder Access in Windows 10
    Turn On or Off Controlled Folder Access in Windows Defender Security Center


    Turning on or off Controlled folder access will modify the DWORD value in the protected registry key below.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

    EnableControlledFolderAccess DWORD

    0 = Off
    1 = On


    1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon. (see screenshot below)

    Name:  Windows_Defender_Controlled_folder_access-1.jpg
Views: 3889
Size:  48.0 KB

    2. Click/tap on the Manage ransomware protection link under the Ransomware protection section. (see screenshot below)

    Name:  Windows_Defender_Controlled_folder_access-2.jpg
Views: 5495
Size:  61.6 KB

    3. Turn On or Off (default) Controlled folder access for what you want. (see screenshots below)

    Name:  Windows_Defender_Controlled_folder_access-3.jpg
Views: 3889
Size:  53.6 KB Name:  Windows_Defender_Controlled_folder_access-4.jpg
Views: 3892
Size:  57.5 KB

    4. Click/tap on Yes when prompted by UAC to approve.

    5. When finished, you can close Windows Defender Security Center if you like.






    Enable or Disable Controlled Folder Access in Windows 10 OPTION TWO Enable or Disable Controlled Folder Access in Windows 10
    Turn On or Off Controlled Folder Access in PowerShell

    1. Open an elevated PowerShell.

    2. Enter the command below you want to use into the elevated PowerShell, and press Enter. (see screenshots below)

    (Default - Turn off Controlled folder access)
    Set-MpPreference -EnableControlledFolderAccess Disabled

    OR

    (Turn on Controlled folder access)
    Set-MpPreference -EnableControlledFolderAccess Enabled

    3. You can now close the elevated PowerShell if you like.

    Name:  Turn_OFF_Controlled_folder_access_PowerShell.png
Views: 3884
Size:  17.3 KB Name:  Turn_ON_Controlled_folder_access_PowerShell.png
Views: 3889
Size:  17.0 KB






    Enable or Disable Controlled Folder Access in Windows 10 OPTION THREE Enable or Disable Controlled Folder Access in Windows 10
    Enable or Disable Controlled Folder Access in Local Group Policy Editor


    If this option is enabled or disabled, it will prevent turning on or off Controlled folder access using Option One and Option Two.

    The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

    All editions can use Option Four below.

    1. Open the Local Group Policy Editor.

    2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)

    Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled folder access

    Name:  Controlled_folder_access_gpedit-1.jpg
Views: 3910
Size:  67.1 KB

    3. In the right pane of Controlled folder access in Local Group Policy Editor, double click/tap on the Configure Controlled folder access policy to edit it. (see screenshot above)

    4. Do step 5 (default), step 6 (enable), or step 7 (disable) below for what you would like to do.


     5. To Use Default Controlled Folder Access Settings

    A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 8 below. (see screenshots below)

    Not Configured is the default setting.


     6. To Always Enable Controlled Folder Access

    A) Select (dot) Enabled, select Block in the "Configure the guard my folders feature" drop menu, click/tap on OK, and go to step 8 below. (see screenshots below)


     7. To Always Disable Controlled Folder Access

    A) Select (dot) Enabled, select Disable (Default) in the "Configure the guard my folders feature" drop menu, click/tap on OK, and go to step 8 below. (see screenshots below)

    Name:  Controlled_folder_access_gpedit-2.jpg
Views: 3888
Size:  99.6 KB Name:  Controlled_folder_access_gpedit-3.jpg
Views: 3890
Size:  93.4 KB

    8. When finished, close the Local Group Policy Editor.






    Enable or Disable Controlled Folder Access in Windows 10 OPTION FOUR Enable or Disable Controlled Folder Access in Windows 10
    Enable or Disable Controlled Folder Access using a REG file


    If this option is enabled or disabled, it will prevent turning on or off Controlled folder access using Option One and Option Two.

    The downloadable .reg files below will add and modify the DWORD values in the registry key below.

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

    EnableControlledFolderAccess DWORD

    (delete) = Default
    0 = Disable
    1 = Enable


    1. Do step 2 (default), step 3 (enable), or step 4 (disable) below for what you would like to do.


     2. To Use Default Controlled Folder Access Settings

    This is the default setting.

    A) Click/tap on the Download button below to download the file below, and go to step 5 below.

    Default_Controlled_Folder_Access.reg

    download


     3. To Always Enable Controlled Folder Access

    A) Click/tap on the Download button below to download the file below, and go to step 5 below.

    Always_Enable_Controlled_Folder_Access.reg

    download


     4. To Always Disable Controlled Folder Access

    A) Click/tap on the Download button below to download the file below, and go to step 5 below.

    Disable_Controlled_Folder_Access.reg

    download

    5. Save the .reg file to your desktop.

    6. Double click/tap on the downloaded .reg file to merge it.

    7. When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

    8. You can now delete the downloaded .reg file if you like.


    That's it,
    Shawn





  1. Anak's Avatar
    Posts : 430
    10 Home 64-bit | v1803 | Build -17134.345
       27 Aug 2018 #1

    Hi Shawn!

    @Brink Thank you for this tutorial it was very helpful for me to understand what was going on with my machine.

    I've had this machine (system specs one) since before build 16232. and I'm now up to 17134.228 and it's only been the last 3weeks that CFA (controlled folder access) stopped me from doing things that were previously allowed, like:

    • Saving snips to my desktop or to anywhere else.
    • Saving work from Paint to the desktop or to anywhere else.
    • Wouldn't allow FastStone viewer to save anywhere until I allowed it through CFA.

    I did run a sfc /scannow but that didn't help, so I followed Option One and turned CFA off through Windows Defender Security Center, now it seems everything is back to normal...Name:  15_10_2.gif
Views: 2515
Size:  3.4 KB . I do get paranoid about security, but not as much as Microsoft evidently does as I don't do any of that dark stuff on the web.

    What gets me though is except for FastStone, Paint and Snip are core Windows products; When I would save, a dialog box appeared and said it couldn't find the Folder destination then the slide out appeared in the lower right corner saying CFA stopped the unauthorized access.

    Say what??

    I'll be keepin' an eye on that CFA switch in Defender and if things get rough I saved the .reg D/L's in option four, seems the only reg key that shows CFA in my registry is:
    Code:
    Computer\HKEY_USERS\S-1-5-21-3159120880-765337408-3114054177-1001_Classes\Local Settings\MrtCache\C:%5CWINDOWS%5CSystemResources%5CMicrosoft.Windows.SecHealthUI%5CMicrosoft.Windows.SecHealthUI.pri\1d4045eaee39991\326bcf6e
    And its Value with one of those torn scratch paper with a red ab icons at the beginning:
    Code:
    @{windows?ms-resource://Microsoft.Windows.SecHealthUI/resources/ThreatSettingsPage_FolderGuard_Title}   REG_SZ  Controlled folder access
    Would you know of any reason why CFA would start acting up now? Meanwhile I'll do a search for Controlled folder access through the forums and see what I can find.

    Thanks again Shawn, rep given.

    Steve
      My ComputersSystem Spec

  2. Brink's Avatar
    Posts : 33,175
    64-bit Windows 10 Pro build 18262
    Thread Starter
       27 Aug 2018 #2

    Hello Steve,

    I'm not sure why CFA would block Paint and Snip since they are Microsoft apps, but you could try adding them as an "allowed app" to see if that may stop this while CFA is turned on.

    Add or Remove Allowed Apps for Controlled Folder Access in Windows 10 | Windows 10 Tutorials
      My ComputersSystem Spec

  3. Anak's Avatar
    Posts : 430
    10 Home 64-bit | v1803 | Build -17134.345
       27 Aug 2018 #3

    Okay I'll give that a go, but not right away as I have chores to do, I'll post later.

    Do you think that reg key could be an orphan?
      My ComputersSystem Spec

  4. Brink's Avatar
    Posts : 33,175
    64-bit Windows 10 Pro build 18262
    Thread Starter
       27 Aug 2018 #4

    I'm not sure about the reg key.
      My ComputersSystem Spec

  5. Anak's Avatar
    Posts : 430
    10 Home 64-bit | v1803 | Build -17134.345
       27 Aug 2018 #5

    Brink said: View Post
    Hello Steve,

    I'm not sure why CFA would block Paint and Snip since they are Microsoft apps, but you could try adding them as an "allowed app" to see if that may stop this while CFA is turned on.

    Add or Remove Allowed Apps for Controlled Folder Access in Windows 10 | Windows 10 Tutorials
    Hi Shawn,

    After reading up on this I did add faststone, snip an paint to the CFA allowed apps with a reboot and the reboot it seems is important and I'm good to go again. I saw where @Cliff S; took a whole Saturday to add his programs, but I'm going to do mine on a need to go basis and we can only hope microsoft follows your suggestion of having the CFA act as an adjunct UAC.

    If you haven't already why don't you bring this up at the next MVP picnic? The white-shirts probably already have an answer like; Well, we thought of that but we can't trust the common folk to make the right choice...Arghhhhh!

    Thanks for your help, and listening...Steve
      My ComputersSystem Spec

  6. Brink's Avatar
    Posts : 33,175
    64-bit Windows 10 Pro build 18262
    Thread Starter
       27 Aug 2018 #6

    You're most welcome Steve.

    If you like, here's something to help make it easier to add apps to the allowed CFA list as needed.

    Add Allow App through Controlled Folder Access context menu Windows 10 | Windows 10 Tutorials
      My ComputersSystem Spec

  7. Anak's Avatar
    Posts : 430
    10 Home 64-bit | v1803 | Build -17134.345
       27 Aug 2018 #7

    Thanks Shawn, I have your great suggestion bookmarked and I'll add it tomorrow during my "morning session" coffee!

    Have a great evening!
      My ComputersSystem Spec

  8. Brink's Avatar
    Posts : 33,175
    64-bit Windows 10 Pro build 18262
    Thread Starter
       27 Aug 2018 #8

      My ComputersSystem Spec


 

Tutorial Categories

Enable or Disable Controlled Folder Access in Windows 10 Tutorial Index Network & Sharing Instalation and Upgrade Browsers and Email General Tips Gaming Customization Apps and Features Virtualization BSOD System Security User Accounts Hardware and Drivers Updates and Activation Backup and Restore Performance and Maintenance Xbox Windows Phone


Related Threads
Is anyone using Windows Defender Controlled folder access? in AntiVirus, Firewalls and System Security
I was not aware of Windows Defender's built in Ransomware protection! However the first problem I have encountered is that my games can't access the documents folder to grab the save file/game settings etc! It is a great idea but seems very...
I have three systems in my home LAN. I would like to do all this work just once, and then replicate the settings across the other two systems. How could I accomplish this?
cannot change CONTROLLED FOLDER ACCESS option in Windows Defender in AntiVirus, Firewalls and System Security
177065
Controlled Folder Access in AntiVirus, Firewalls and System Security
I have followed all of the instructions given to enable access to 'Controlled Folder access' but for whatever reason I do not seem to have this option available to me. Can anyone throw any light on this for me please. Many thanks.
Solved Controlled folder access is greyed out in AntiVirus, Firewalls and System Security
In the new Fall update there is a controlled folder access option. Which I would much like to use. I think it is meant to be on by default, for at least basic protection.. Mine is both off and greyed out so that I can not turn it on. I've read a...

Tags for this Thread

Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 09:37.
Find Us