# Controlled folder access: ransomware protection with a maintenance bill

> What it protects, why legitimate apps get blocked, and how to keep it useful instead of turning it off.

**Tested on**

- Build: 26300.9457 / 26100.33650
- Edition: Pro (26H2) / Server
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Controlled folder access (CFA) allows only **trusted applications** to write to a set of protected folders — by default your Documents, Pictures, Videos, Music, Desktop and Favorites.

- It blocks **unauthorised processes** from modifying those folders, which is what ransomware does first.
- It does **not** care whether the process is malicious: a legitimate backup tool, a sync client or a game launcher can be blocked too.

The cost is real. The benefit is real. Decide with both in view.

## Check the state

```powershell
Get-MpPreference | Select-Object EnableControlledFolderAccess,ControlledFolderAccessProtectedFolders,ControlledFolderAccessAllowedApplications
```

| Value | Meaning |
|---|---|
| `0` | off |
| `1` | block mode |
| `2` | audit mode (logs only) |

Start with **audit mode** for a week: you will see what would have been blocked without breaking anything.

## Turn it on the sane way

1. **Windows Security → Virus & threat protection → Manage ransomware protection → Controlled folder access**.
2. Enable it.
3. Break something. Note the app.
4. **Allow an app through Controlled folder access** → add that executable.
5. Repeat until quiet.

```powershell
# allow an app (use the exe path, not the folder)
Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Program Files\Vendor\app.exe'
# add an extra protected folder
Add-MpPreference -ControlledFolderAccessProtectedFolders 'D:\Projects'
```

> **Caution: Do not allow an entire folder of executables**
>
> Adding `C:\Program Files\Vendor\` as an allowed application does not work — the list takes executables. Allowing a temp folder or a download folder defeats the protection entirely.

## What gets blocked most often

| App type | Why it trips |
|---|---|
| Backup tools | they write into Documents by design |
| Sync clients (non-OneDrive) | same |
| Games with save folders in Documents | very common |
| Photo/video editors | write to Pictures/Videos |
| Scripts run from Task Scheduler | parent process not trusted |
| Command-line tools | `cmd.exe`/`powershell.exe` writing files |

For scripts, allow the **host** executable (`powershell.exe`) only if you accept the risk — it is a broad allowance.

## Where it stops

- It protects **folders on local drives**, not network shares.
- It does not stop a process that has already been granted access.
- It does not encrypt anything or replace backups.
- It does not cover **removable drives** by default.

The honest framing: CFA makes the first minute of a ransomware attack noisier. It does not survive a determined attacker with admin rights and time.

## Pairing it with something that actually saves you

| Layer | Purpose |
|---|---|
| CFA | slows unauthorised writes |
| **Offline/versioned backup** | the only real recovery |
| OneDrive version history | recovery for synced files, if the account is not compromised |
| Standard user account | prevents silent driver/service installs |

See [backup that survives ransomware](https://windows.homes/en/windows/security/backup/).

## Related

- [Core isolation and HVCI](https://windows.homes/en/windows/hardening/core-isolation/)
- [BitLocker recovery drill](https://windows.homes/en/windows/hardening/bitlocker-recovery-drill/)
- [Backup that survives ransomware](https://windows.homes/en/windows/security/backup/)

## Lab boundary

E1. CFA behaviour is documented by Microsoft. The lab VMs run Defender in its default configuration, so no block event was produced here.

## Sources

- [Microsoft Learn — Controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folders)
- [Microsoft Learn — Microsoft Defender SmartScreen](https://learn.microsoft.com/en-us/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/)
- [Microsoft Learn — Identity protection](https://learn.microsoft.com/en-us/windows/security/identity-protection/)

---

Source: https://windows.homes/en/windows/hardening/controlled-folder-access/