How to Controlled Folder Access in Windows Defender Exploit

Overview

This guide explains how to controlled folder access in Windows defender exploit in clear, practical terms. It covers the key concepts, recommended steps, common limitations, and useful checks so you can make a better-informed decision.

Controlled Folder Access is a feature of Microsoft's Windows Security desktop antivirus application. It prevents ransomware by preventing files in protected folders from being modified. Enabling Controlled Folder Access prevents untrusted applications, malware, or other means from changing files in protected folders.

Controlled Folder Access is an additional security feature in Windows 10 and 11 that some users appreciate. Ransomware is not something to be taken lightly and enabling this feature will keep your system and user files extra safe. Here are 4 ways you can enable Controlled Folder Access in Windows.

How to enable Controlled Folder Access in Windows Security

The Controlled Folder Access setting is located under Ransomware Protection in the Windows Security app. It's easy to find and turn it on/off once you know where it is. Here's how to turn on Controlled Folder Access in the Windows Security app.

1. To open the Windows Security application, double-click its system tray icon.

2. Select the Virus & threat protection tab of Windows Security.

3. Click Manage ransomware protection to go to Controlled Folder Access settings.

4. Now, turn on the Controlled Folder Access option to enable that feature.

Controlled Folder Access protects the Documents, Videos, Pictures, and Music user folders when enabled. To see a list of protected user folders, click Protected folder. You can add more to the list by clicking the Add protected folder button, selecting a folder, and clicking Select Folder.

How to Enable Controlled Folder Access Using PowerShell

Windows PowerShell provides you with an alternative method to enable and disable Controlled Folder Access by executing commands. You can enable Controlled Folder Access using PowerShell as follows:

1. To activate the file search tool, press Win + S.

2. Type PowerShell in the enabled search utility.

3. Open PowerShell with admin rights by selecting Run as administrator.

4. To enable Controlled Folder Access, type this command text and press Enter:

Set-MpPreference -EnableControlledFolderAccess Enabled

5. You can disable Controlled Folder Access by executing this command:

Set-MpPreference -EnableControlledFolderAccess Disabled

How to enable Controlled Folder Access with Group Policy Editor

If you have Windows 11 Pro or Enterprise, you can enable Controlled Folder Access using the Group Policy Editor. The Group Policy Editor also includes some additional configuration settings for Controlled Folder Access. Here's how to enable Controlled Folder Access via GPE.

Note: If you are using Windows Home, Group Policy Editor will not appear by default.

1. Open the Windows search tool and type gpedit. msc in it.

2. Select gpedit. msc to display the Group Policy Editor.

3. Click Computer Configuration > Administrative Templates in the left pane of Group Policy Editor.

4. Double-click Windows Components to expand it.

5. Click the arrows to expand Microsoft Defender Antivirus and Microsoft Defender Exploit Guard.

6. Select Controlled Folder Access to view the policy settings for that feature.

7. Then double-click on Configure Controlled folder access to see that setting's window.

8. Select Enabled for the Configure Controlled folder access window.

9. Click Block on the drop-down menu to select the strictest CFA mode. However, you can also select the Audit Mode, Block disk notification only, and Audit disk notification only options to allow Controlled Folder Access.

10. Select Apply in the Configure Controlled folder access window.

11. Click the OK button of the Configure Controlled folder access window.

How to enable Controlled Folder Access from Windows context menu

Alternatively, you can create a context menu shortcut to enable/disable Controlled Folder Access. Then you will be able to access the Turn on Controlled folder access setting from the Windows desktop area. You can add such a CFA option to the right-click menu by setting up and running a registry script as follows:

1. Open Notepad.

2. Then select this script text and press Ctrl + C:

Windows Registry Editor Version 5.00 ; Created by: Shawn Brink ; Created on: July 19th 2018 ; Tutorial: the referenced website [HKEY_CLASSES_ROOTDesktopBackgroundShellControlledFolderAccess] "HasLUAShield"="" "Icon"="%ProgramFiles%Windows DefenderEppManifest.dll,-101" "MUIVerb"="Turn On or Off Control folder access" "Position"="Bottom" "SubCommands"="" [HKEY_CLASSES_ROOTDesktopBackgroundShellControlledFolderAccessshell?01flyout] "MUIVerb"="Turn on Control folder access" "HasLUAShield"="" "Icon"="%ProgramFiles%Windows DefenderEppManifest.dll,-101" [HKEY_CLASSES_ROOTDesktopBackgroundShellControlledFolderAccessshell?01flyoutcommand] @="PowerShell -windowstyle hidden -Command "Start-Process cmd -ArgumentList '/s,/c,start PowerShell.exe Set-MpPreference -EnableControlledFolderAccess Enabled' -Verb RunAs"" [HKEY_CLASSES_ROOTDesktopBackgroundShellControlledFolderAccessshell?02flyout] "MUIVerb"="Turn off Control folder access" "HasLUAShield"="" "Icon"="%ProgramFiles%Windows DefenderEppManifest.dll,-101" [HKEY_CLASSES_ROOTDesktopBackgroundShellControlledFolderAccessshell?02flyoutcommand] @="PowerShell -windowstyle hidden -Command "Start-Process cmd -ArgumentList '/s,/c,start PowerShell.exe Set-MpPreference -EnableControlledFolderAccess Disabled' -Verb RunAs""

3. Paste that script into Notepad by clicking on the application's window and pressing Ctrl + V.

4. Next, press Ctrl + Shift + S to view Notepad's Save as window.

5. Set the Save as type option to All files.

6. Type Turn on Control folder access. reg inside the file name box.

7. Choose to save the script to the desktop location.

8. Select Save to add the Turn on Control folder access registry file to the desktop.

9. Close the Notepad editor and double-click the Turn on Control folder access. reg file on the desktop.

10. Select Yes to confirm that you trust the script.

You can now enable Controlled Folder Access from the Windows context menu.

Key Takeaways

Use the guidance above as a practical reference for controlled folder access in Windows defender exploit guard. Check compatibility, follow the steps carefully, and verify important details with official documentation when software, security, accounts, health, or purchases are involved.

FAQ

How do I controlled folder access in Windows defender exploit?

Follow the steps in this guide in order, confirm each setting before continuing, and save, restart, or reconnect the device when the instructions require it.

What should I check before I begin?

Confirm the correct device, account access, software version, compatibility, and a current backup whenever the process could affect files, settings, or security.

What should I do if the process does not work?

Repeat the steps carefully, check for model or version differences, install available updates, and consult the manufacturer's official support documentation.