How to Enable or Disable Controlled Folder Access in Windows 10  

Page 1 of 4 123 ... LastLast
    How to Enable or Disable Controlled Folder Access in Windows 10

    How to Enable or Disable Controlled Folder Access in Windows 10

    Published by Category: Security System
    01 Nov 2022
    Designer Media Ltd

    How to Enable or Disable Controlled Folder Access in Windows 10


    Starting with Windows 10 build 16232, Controlled folder access is introduced in Microsoft Defender Antivirus.

    Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware.

    Controlled folder access in Windows Security reviews the apps that can make changes to files in protected folders. Occasionally, an app that is safe to use will be identified as harmful. This happens because Microsoft wants to keep you safe and will sometimes err on the side of caution; however, this might interfere with how you normally use your PC. You can add an app to the list of safe or allowed apps to prevent them from being blocked.

    You can add additional folders to the list of protected folders, but you cannot alter the default list, which includes folders such as Documents, Pictures, Movies, and Desktop. Adding other folders to Controlled folder access can be handy, for example, if you don’t store files in the default Windows libraries or you’ve changed the location of the libraries away from the defaults.

    For more details about Controlled folder access, see:

    This tutorial will show you how to enable or disable Controlled folder access in Windows 10.

    You must be signed in as an administrator to enable or disable Controlled folder access.



    Contents

    • Option One: Turn On or Off Controlled Folder Access in Windows Security
    • Option Two: Turn On or Off Controlled Folder Access in PowerShell
    • Option Three: Enable or Disable Controlled Folder Access in Local Group Policy Editor
    • Option Four: Enable or Disable Controlled Folder Access using a REG file






    OPTION ONE

    Turn On or Off Controlled Folder Access in Windows Security


    Turning on or off Controlled folder access will modify the DWORD value in the protected registry key below.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

    EnableControlledFolderAccess DWORD

    0 = Off
    1 = On


    1 Open Windows Security, and click/tap on the Virus & threat protection icon. (see screenshot below)

    How to Enable or Disable Controlled Folder Access in Windows 10-windows_defender_controlled_folder_access-1.jpg

    2 Click/tap on the Manage ransomware protection link under the Ransomware protection section. (see screenshot below)

    How to Enable or Disable Controlled Folder Access in Windows 10-windows_defender_controlled_folder_access-2.jpg

    3 Turn On or Off (default) Controlled folder access for what you want. (see screenshots below)

    How to Enable or Disable Controlled Folder Access in Windows 10-windows_defender_controlled_folder_access-3.jpg How to Enable or Disable Controlled Folder Access in Windows 10-windows_defender_controlled_folder_access-4.jpg

    4 Click/tap on Yes when prompted by UAC to approve.

    5 When finished, you can close Windows Security if you like.






    OPTION TWO

    Turn On or Off Controlled Folder Access in PowerShell


    1 Open an elevated PowerShell.

    2 Type the command below you want to use into the elevated PowerShell, and press Enter. (see screenshots below)

    (Default - Turn off Controlled folder access)
    Set-MpPreference -EnableControlledFolderAccess Disabled

    OR

    (Turn on Controlled folder access)
    Set-MpPreference -EnableControlledFolderAccess Enabled

    3 You can now close the elevated PowerShell if you like.

    How to Enable or Disable Controlled Folder Access in Windows 10-turn_off_controlled_folder_access_powershell.png How to Enable or Disable Controlled Folder Access in Windows 10-turn_on_controlled_folder_access_powershell.png






    OPTION THREE

    Enable or Disable Controlled Folder Access in Local Group Policy Editor


    If this option is enabled or disabled, it will prevent turning on or off Controlled folder access using Option One and Option Two.


    The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

    All editions can use Option Four below.


    1 Open the Local Group Policy Editor.

    2 In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)

    Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Antivirus\Microsoft Defender Exploit Guard\Controlled folder access

    How to Enable or Disable Controlled Folder Access in Windows 10-controlled_folder_access_gpedit-1.jpg

    3 In the right pane of Controlled folder access in Local Group Policy Editor, double click/tap on the Configure Controlled folder access policy to edit it. (see screenshot above)

    4 Do step 5 (default), step 6 (enable), or step 7 (disable) below for what you would like to do.


    5 To Use Default Controlled Folder Access Settings

    A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 8 below. (see screenshots below)

    Not Configured is the default setting.


    6 To Always Enable Controlled Folder Access

    A) Select (dot) Enabled, select Block in the "Configure the guard my folders feature" drop menu, click/tap on OK, and go to step 8 below. (see screenshots below)


    7 To Always Disable Controlled Folder Access

    A) Select (dot) Enabled, select Disable (Default) in the "Configure the guard my folders feature" drop menu, click/tap on OK, and go to step 8 below. (see screenshots below)

    How to Enable or Disable Controlled Folder Access in Windows 10-controlled_folder_access_gpedit-2.jpg How to Enable or Disable Controlled Folder Access in Windows 10-controlled_folder_access_gpedit-3.jpg

    8 When finished, close the Local Group Policy Editor.






    OPTION FOUR

    Enable or Disable Controlled Folder Access using a REG file


    If this option is enabled or disabled, it will prevent turning on or off Controlled folder access using Option One and Option Two.


    The downloadable .reg files below will add and modify the DWORD values in the registry key below.

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

    EnableControlledFolderAccess DWORD

    (delete) = Default
    0 = Disable
    1 = Enable


    1 Do step 2 (default), step 3 (enable), or step 4 (disable) below for what you would like to do.


    2 To Use Default Controlled Folder Access Settings

    This is the default setting.

    A) Click/tap on the Download button below to download the file below, and go to step 5 below.

    Default_Controlled_Folder_Access.reg

    Download


    3 To Always Enable Controlled Folder Access

    A) Click/tap on the Download button below to download the file below, and go to step 5 below.

    Always_Enable_Controlled_Folder_Access.reg

    Download


    4 To Always Disable Controlled Folder Access

    A) Click/tap on the Download button below to download the file below, and go to step 5 below.

    Disable_Controlled_Folder_Access.reg

    Download

    5 Save the .reg file to your desktop.

    6 Double click/tap on the downloaded .reg file to merge it.

    7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

    8 You can now delete the downloaded .reg file if you like.


    That's it,
    Shawn Brink






  1. Posts : 1,800
    10 Home 64-bit | v22H2 | Build - 19045.3930
       #1

    Hi Shawn!

    @Brink Thank you for this tutorial it was very helpful for me to understand what was going on with my machine.

    I've had this machine (system specs one) since before build 16232. and I'm now up to 17134.228 and it's only been the last 3weeks that CFA (controlled folder access) stopped me from doing things that were previously allowed, like:

    • Saving snips to my desktop or to anywhere else.
    • Saving work from Paint to the desktop or to anywhere else.
    • Wouldn't allow FastStone viewer to save anywhere until I allowed it through CFA.

    I did run a sfc /scannow but that didn't help, so I followed Option One and turned CFA off through Windows Defender Security Center, now it seems everything is back to normal...How to Enable or Disable Controlled Folder Access in Windows 10-15_10_2.gif . I do get paranoid about security, but not as much as Microsoft evidently does as I don't do any of that dark stuff on the web.

    What gets me though is except for FastStone, Paint and Snip are core Windows products; When I would save, a dialog box appeared and said it couldn't find the Folder destination then the slide out appeared in the lower right corner saying CFA stopped the unauthorized access.

    Say what??

    I'll be keepin' an eye on that CFA switch in Defender and if things get rough I saved the .reg D/L's in option four, seems the only reg key that shows CFA in my registry is:
    Code:
    Computer\HKEY_USERS\S-1-5-21-3159120880-765337408-3114054177-1001_Classes\Local Settings\MrtCache\C:%5CWINDOWS%5CSystemResources%5CMicrosoft.Windows.SecHealthUI%5CMicrosoft.Windows.SecHealthUI.pri\1d4045eaee39991\326bcf6e
    And its Value with one of those torn scratch paper with a red ab icons at the beginning:
    Code:
    @{windows?ms-resource://Microsoft.Windows.SecHealthUI/resources/ThreatSettingsPage_FolderGuard_Title}   REG_SZ  Controlled folder access
    Would you know of any reason why CFA would start acting up now? Meanwhile I'll do a search for Controlled folder access through the forums and see what I can find.

    Thanks again Shawn, rep given.

    Steve
      My Computers


  2. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #2

    Hello Steve,

    I'm not sure why CFA would block Paint and Snip since they are Microsoft apps, but you could try adding them as an "allowed app" to see if that may stop this while CFA is turned on.

    Add or Remove Allowed Apps for Controlled Folder Access in Windows 10 | Windows 10 Tutorials
      My Computers


  3. Posts : 1,800
    10 Home 64-bit | v22H2 | Build - 19045.3930
       #3

    Okay I'll give that a go, but not right away as I have chores to do, I'll post later.

    Do you think that reg key could be an orphan?
      My Computers


  4. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #4

    I'm not sure about the reg key.
      My Computers


  5. Posts : 1,800
    10 Home 64-bit | v22H2 | Build - 19045.3930
       #5

    Brink said:
    Hello Steve,

    I'm not sure why CFA would block Paint and Snip since they are Microsoft apps, but you could try adding them as an "allowed app" to see if that may stop this while CFA is turned on.

    Add or Remove Allowed Apps for Controlled Folder Access in Windows 10 | Windows 10 Tutorials
    Hi Shawn,

    After reading up on this I did add faststone, snip an paint to the CFA allowed apps with a reboot and the reboot it seems is important and I'm good to go again. I saw where @Cliff S; took a whole Saturday to add his programs, but I'm going to do mine on a need to go basis and we can only hope microsoft follows your suggestion of having the CFA act as an adjunct UAC.

    If you haven't already why don't you bring this up at the next MVP picnic? The white-shirts probably already have an answer like; Well, we thought of that but we can't trust the common folk to make the right choice...Arghhhhh!

    Thanks for your help, and listening...Steve
      My Computers


  6. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #6

    You're most welcome Steve.

    If you like, here's something to help make it easier to add apps to the allowed CFA list as needed.

    Add Allow App through Controlled Folder Access context menu Windows 10 | Windows 10 Tutorials
      My Computers


  7. Posts : 1,800
    10 Home 64-bit | v22H2 | Build - 19045.3930
       #7

    Thanks Shawn, I have your great suggestion bookmarked and I'll add it tomorrow during my "morning session" coffee!

    Have a great evening!
      My Computers


  8. Posts : 68,543
    64-bit Windows 11 Pro for Workstations
    Thread Starter
       #8

      My Computers


  9. Posts : 2,487
    Windows 10 Home, 64-bit
       #9

    Shawn:

    I was totally unaware of CFA and just enabled it for the first time using option 1.

    Can I assume this protects recursively down through a folder tree such as D:\ or E:\ ??? I'd certainly hope it does as I have thousands of folders within both D and E. I don't use C:\ for personal stuff at all.

    Any known issues or misgivings with this control?

    I also have ransomware protection enabled on Malwarebytes and I wonder if one conflicts with the other or if using both is overkill?

    Thanks.
      My Computer


 

Tutorial Categories

How to Enable or Disable Controlled Folder Access in Windows 10 Tutorial Index Network & Sharing Instalation and Upgrade Browsers and Email General Tips Gaming Customization Apps and Features Virtualization BSOD System Security User Accounts Hardware and Drivers Updates and Activation Backup and Restore Performance and Maintenance Mixed Reality Phone


  Related Discussions
Our Sites
Site Links
About Us
Windows 10 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 10" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 02:51.
Find Us




Windows 10 Forums