Skip to content
WinBookUnofficial

Controlled folder access: ransomware protection with a maintenance bill

Verified 2 min read

What it protects, why legitimate apps get blocked, and how to keep it useful instead of turning it off.

Tested onPro (26H2) / Server · Build 26300.9457 / 26100.33650 · x64
E1
Build
26300.9457 / 26100.33650
Edition
Pro (26H2) / Server
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Task

The short answer

Section titled “The short answer”

Controlled folder access (CFA) allows only trusted applications to write to a set of protected folders — by default your Documents, Pictures, Videos, Music, Desktop and Favorites.

  • It blocks unauthorised processes from modifying those folders, which is what ransomware does first.
  • It does not care whether the process is malicious: a legitimate backup tool, a sync client or a game launcher can be blocked too.

The cost is real. The benefit is real. Decide with both in view.

Check the state

Section titled “Check the state”
Terminal window
Get-MpPreference | Select-Object EnableControlledFolderAccess,ControlledFolderAccessProtectedFolders,ControlledFolderAccessAllowedApplications
Value Meaning
0 off
1 block mode
2 audit mode (logs only)

Start with audit mode for a week: you will see what would have been blocked without breaking anything.

Turn it on the sane way

Section titled “Turn it on the sane way”
  1. Windows Security → Virus & threat protection → Manage ransomware protection → Controlled folder access.
  2. Enable it.
  3. Break something. Note the app.
  4. Allow an app through Controlled folder access → add that executable.
  5. Repeat until quiet.
Terminal window
# allow an app (use the exe path, not the folder)
Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\Program Files\Vendor\app.exe'
# add an extra protected folder
Add-MpPreference -ControlledFolderAccessProtectedFolders 'D:\Projects'

What gets blocked most often

Section titled “What gets blocked most often”
App type Why it trips
Backup tools they write into Documents by design
Sync clients (non-OneDrive) same
Games with save folders in Documents very common
Photo/video editors write to Pictures/Videos
Scripts run from Task Scheduler parent process not trusted
Command-line tools cmd.exe/powershell.exe writing files

For scripts, allow the host executable (powershell.exe) only if you accept the risk — it is a broad allowance.

Where it stops

Section titled “Where it stops”
  • It protects folders on local drives, not network shares.
  • It does not stop a process that has already been granted access.
  • It does not encrypt anything or replace backups.
  • It does not cover removable drives by default.

The honest framing: CFA makes the first minute of a ransomware attack noisier. It does not survive a determined attacker with admin rights and time.

Pairing it with something that actually saves you

Section titled “Pairing it with something that actually saves you”
Layer Purpose
CFA slows unauthorised writes
Offline/versioned backup the only real recovery
OneDrive version history recovery for synced files, if the account is not compromised
Standard user account prevents silent driver/service installs

See backup that survives ransomware.

Section titled “Related”

Lab boundary

Section titled “Lab boundary”

E1. CFA behaviour is documented by Microsoft. The lab VMs run Defender in its default configuration, so no block event was produced here.

Sources