How to Turn On Controlled Folder Access Against Ransomware

Ransomware doesn't need administrator privileges to ruin your day: it just runs as your user and starts rewriting everything in Documents, Pictures and Desktop. That is why Microsoft built a Windows feature almost nobody turns on: Controlled Folder Access (CFA). It works like a guest list: only trusted apps can modify your important folders. Here is the step-by-step to turn it on, allow what is legitimate and check what got blocked.

What does Controlled Folder Access do?

What is Controlled Folder Access in Windows?

It is a Microsoft Defender feature that stops untrusted applications from modifying files in protected folders, which directly disrupts typical ransomware behavior: open, encrypt and overwrite your files.

According to Microsoft's documentation, the feature protects common system folders by default, such as Documents, Pictures, Videos, Music, Favorites and Desktop, and you can add others. Defender decides which apps are trusted based on reputation and prevalence; everything else needs manual approval. It does not replace the 3-2-1 backup, but it is a cheap layer that raises the odds the attack dies at the first file instead of the thousandth.

Step 1: turn it on in the Windows 11 interface

1. Open Windows Security (Start, type the name).
2. Go to Virus & threat protection.
3. Scroll to Ransomware protection and click Manage ransomware protection.
4. Switch on Controlled folder access and confirm the UAC prompt.

One requirement that trips people up: the feature depends on Microsoft Defender being the active antivirus with real-time protection on. If you installed another antivirus that took over the main role, the option may appear disabled or simply not work.

Step 2: turn it on (and test first) with PowerShell

Microsoft recommends starting in audit mode, where nothing is blocked and everything becomes a log entry. You get to see which of your programs would be stopped before enforcing the rule. In a PowerShell window running as administrator:

# Audit mode: only logs, does not block
Set-MpPreference -EnableControlledFolderAccess AuditMode

# After a few days without surprises, turn it on for real
Set-MpPreference -EnableControlledFolderAccess Enabled

# Check the current state (0 = off, 1 = on, 2 = audit)
(Get-MpPreference).EnableControlledFolderAccess

On a home PC it is reasonable to jump straight to Enabled and allow whatever breaks. If the PC is for work, with accounting software, ERP or legacy tools, the week of auditing is worth it.

Step 3: protect other folders and allow legitimate apps

The default folders cover the basics, but work data often lives in D:\Projects or in a photo folder on another disk. Add them, and allow the programs that need to write there:

# Add a folder to the protected list
Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Projetos"

# Allow a specific app (full path to the executable)
Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\MeuApp\meuapp.exe"

# List what is already configured
(Get-MpPreference).ControlledFolderAccessProtectedFolders
(Get-MpPreference).ControlledFolderAccessAllowedApplications

In the interface, the path is the same as in step 1: Protected folders and Allow an app through Controlled folder access. Only allow executables you recognize. Allowing the wrong app just to make the notification go away throws the protection out.

Step 4: what to do when something is blocked

Why does Windows say "Unauthorized changes blocked"?

Because an application Defender does not consider trusted tried to write to a protected folder; if you know the program, allow its executable, and if you don't, leave it blocked and investigate.

That warning is the feature doing its job. Before allowing anything, ask: did I just open this program? Did I install something today? If the answer is no, treat it as suspicious and follow the checklist to find out if your PC was hacked. Blocks are recorded in Event Viewer, under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational. According to Microsoft, event 1123 means access was blocked, 1124 means access was logged in audit mode and 5007 means a settings change. In PowerShell:

Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-Windows Defender/Operational'
  Id      = 1123, 1124
} -MaxEvents 20 | Select-Object TimeCreated, Id, Message

If you want to go further with log reading, the post on Get-WinEvent explains filters and pitfalls. And event 5007 is worth watching: ransomware with privileges may try to switch protection off before acting.

What Controlled Folder Access does not solve

• It does not protect against someone who already has control. Malware with administrator privileges can change the configuration. That is why the other defenses still matter, such as those listed in how to protect yourself from ransomware.
• It does not prevent data theft. Modern ransomware copies files before encrypting them, and reading a folder is not the same as changing it.
• It can cause false positives with old programs, games that save to Documents and your own scripts. Tune it with the audit period.
• It does not replace backup. If the disk dies or you delete the file yourself, CFA does not help.

Quick checklist

1. Defender active with real-time protection on.
2. Controlled Folder Access in AuditMode for a few days (or straight to Enabled on a home PC).
3. Data folders outside the defaults added to the list.
4. Legitimate apps allowed by full path.
5. Offline backup tested, because that is what saves you when the defense fails.

It is a five-minute tweak that changes the outcome of the worst-case scenario. For the rest of the settings worth reviewing on your system, continue with the 10 settings that make Windows 11 safer.

Sources: Microsoft documentation on Controlled Folder Access, how to enable it and how to evaluate it in audit mode.