To facilitate this, Controlled Folder Access supports an `audit’ mode, where an event is generated when the application would normally be prevented from writing to a protected folder. Those events can be reviewed to identify legitimate applications that can be added to the white-list. It may be the case that legitimate applications are incorrectly flagged by Windows Defender Anti-Virus as being `suspicious’ preventing or hindering legitimate use. As such Controlled Folder Access relies on Windows Defender Anti-Virus to be running. It’s what Windows Defender Anti-Virus identifies. How does Windows determine what `suspicious’ code is? Public: Documents, Pictures, Videos, Music, Desktop.User: Documents, Pictures, Videos, Music, Desktop, Favorites.While additional folders can be added, the following locations will always be monitored when Controlled Folder Access is enabled: The “Fall Creators” edition (version 1709, codename Redstone 3) contains a new feature called “Controlled Folder Access”, which is designed to combat ransomware attacks.Ĭontrolled Folder Access is part of Windows Defender Security Centre that works with Windows Defender Anti-Virus to prevent “suspicious” executable files, DLLs, and scripts from writing to (or encrypting) files within certain folders.

Microsoft released a rolling upgrade of Windows 10 in October 2017.

Controlled folder access blocked