{"id":5610,"date":"2017-10-21T20:33:59","date_gmt":"2017-10-21T15:03:59","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=5610"},"modified":"2024-07-27T12:07:00","modified_gmt":"2024-07-27T06:37:00","slug":"use-controlled-folder-access-windows-10-windows-defender","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/use-controlled-folder-access-windows-10-windows-defender\/","title":{"rendered":"How to Configure Controlled Folder Access to Stop &#8220;Unauthorized changes blocked&#8221; Notifications"},"content":{"rendered":"<p>Windows 10 and 11 include a beneficial security feature named <strong>Controlled folder access<\/strong>, which is part of the Microsoft Defender Exploit Guard. You may have noticed the <strong>Unauthorized changes blocked <\/strong>notifications. Microsoft Defender&#8217;s Controlled folder access feature is the one behind those notifications. Controlled folder access helps you protect valuable data from malicious programs, such as ransomware.<\/p>\n<p>This article explains how to configure CFA and prevent <strong>Unauthorized changes blocked<\/strong> notifications when running a program.<\/p>\n<p><!--more--><\/p>\n<p><em>Microsoft Defender Exploit Guard is a new set of host intrusion prevention capabilities for Windows 10\/11, allowing you to manage and reduce the attack surface of apps installed on the computer.<\/em><\/p>\n<div id=\"toc\">\n<p class=\"toc_title\">Contents<\/p>\n<ol>\n<li><a href=\"#what\">What is Controlled folder access?<\/a><\/li>\n<li><a href=\"#use\">How to Use Controlled folder access?<\/a>\n<ul>\n<li><a href=\"#enable\">Enabling Controlled folder access<\/a><\/li>\n<li><a href=\"#folders\">Enable protection for additional folder locations<\/a><\/li>\n<li><a href=\"#apps\">Allow an app for Controlled folder access<\/a><\/li>\n<li><a href=\"#apps_all\">Allow recently blocked apps for Controlled folder access<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#manage_ps\">Manage Controlled folder access Using PowerShell<\/a>\n<ul>\n<li><a href=\"#enable_ps\">Enable Controlled folder access using PowerShell<\/a><\/li>\n<li><a href=\"#folders_ps\">Protect additional folders using PowerShell<\/a><\/li>\n<li><a href=\"#apps_ps\">Allow a specific app (Notepad++) using PowerShell<\/a><\/li>\n<li><a href=\"#apps_all_ps\">Allow all blocked apps (interactively) using PowerShell<\/a><\/li>\n<\/ul>\n<\/li>\n<li><a href=\"#trblsht\">Troubleshoot: Controlled folder access option grayed out or inaccessible<\/a><\/li>\n<li><a href=\"#cfa_shortcuts\">[Tip] Enable or disable Controlled folder access using shortcut or command-line<\/a><\/li>\n<\/ol>\n<\/div>\n<h2><a id=\"what\"><\/a>What is Controlled folder access in Windows<\/h2>\n<p><img decoding=\"async\" class=\"alignright size-full wp-image-6635\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/09\/antivirus-shield.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications\" width=\"100\" \/>Controlled folder access is an anti-ransomware feature in Windows that helps protect your documents, files and memory areas on your computer from modification by suspicious or malicious apps (especially ransomware). Controlled folder access is supported on Windows Server 2019 as well as Windows 10\/11.<\/p>\n<p>Sometimes Controlled folder access can <a href=\"https:\/\/www.winhelponline.com\/blog\/error-file-not-found-save-files-desktop-windows-10-controlled-folder-access\/\">block legitimate apps<\/a> from writing to protected folders (such as the Desktop, Documents folders etc), and shows the notification <strong><em>Unauthorized changes blocked<\/em><\/strong>. You an configure Controlled folder access so that you can allow specific applications, as well as add custom folders to the list of &#8220;protected&#8221; folders.<\/p>\n<p>It is especially useful in helping to protect your documents and information from ransomware that can attempt to encrypt your files and hold them hostage.<\/p>\n<h2><a id=\"use\"><\/a>How to Use Controlled folder access?<\/h2>\n<p><em><strong>Prerequisite:<\/strong> Microsoft Defender Antivirus real-time protection must be enabled for the Controlled folder access feature to work.<\/em><\/p>\n<h3><a id=\"enable\"><\/a>Enabling Controlled folder access<\/h3>\n<p>To enable Controlled folder access, use these steps:<\/p>\n<ol>\n<li>Double-click the Defender shield icon in the notification area to open the Microsoft Defender Security Center.<\/li>\n<li>Click Virus &amp; threat protection<\/li>\n<li>Click Virus &amp; threat protection settings\n<p><figure id=\"attachment_5613\" aria-describedby=\"caption-attachment-5613\" style=\"width: 691px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5613\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-howto-enable.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications - Enabling Controlled folder access\" width=\"701\" height=\"533\" \/><figcaption id=\"caption-attachment-5613\" class=\"wp-caption-text\">Enabling Microsoft Defender Controlled folder access<\/figcaption><\/figure><\/li>\n<li>Enable the &#8220;Controlled folder access&#8221; setting. UAC dialog will pop up now for getting your confirmation\/consent.<\/li>\n<\/ol>\n<p>From now on, Controlled folder access monitors the changes that apps make to files in the protected folders.<\/p>\n<h3><a id=\"folders\"><\/a>Enable protection for additional folder locations<\/h3>\n<p>By default, these folders are protected, and there is no way to remove protection for these folders:<\/p>\n<pre><strong>User shell folders:<\/strong> Documents, Pictures, Videos, Music, Favorites, and Desktop\n<strong>Public shell folders:<\/strong> Documents, Pictures, Videos, and Desktop<\/pre>\n<figure id=\"attachment_5612\" aria-describedby=\"caption-attachment-5612\" style=\"width: 691px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5612\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-add-folder.png\" alt=\"Configure Controlled Folder Access - protected folders\" width=\"701\" height=\"533\" \/><figcaption id=\"caption-attachment-5612\" class=\"wp-caption-text\">Controlled folder access &#8212; Protected folders<\/figcaption><\/figure>\n<p>However, some users may not prefer storing their files in the personal shell folders or libraries; they may have their documents in a network share or other locations. In that case, you can bring additional folder locations under Microsoft Defender protection, by clicking <strong>Protected folders<\/strong> link in Microsoft Defender Security Center, and clicking <strong>Add a protected folder<\/strong> button. You can also enter network shares and mapped drives.<\/p>\n<h3><a id=\"apps\"><\/a>Add (whitelist) apps for Controlled folder access<\/h3>\n<p>Microsoft Defender Controlled folder access will block write access (by &#8220;unfriendly&#8221; apps) to files in protected folders. If an app attempts to make a change to these files, and the app is blacklisted by the feature, you\u2019ll get a notification about the attempt.<\/p>\n<p>Just as you can complement the protected folders with additional folder paths, you can also add (whitelist) the apps that you want to allow access to those folders.<\/p>\n<h4>Notepad++ blocked<\/h4>\n<p>In my case, Controlled folder access was blocking the 3rd party text editor program Notepad++ from saving to the desktop.<\/p>\n<div class=\"err\">D:\\Tools\\NPP\\notepad++.exe has been blocked from modifying %desktopdirectory%\\ by Controlled Folder Access.<\/div>\n<p>And an event log entry (<code>Event ID: 1123<\/code>) is generated for the blocked event.<\/p>\n<p>It will be listed under <strong>Applications and Services Logs<\/strong> \u2192 <strong>Microsoft<\/strong> \u2192 <strong>Windows<\/strong> \u2192 <strong>Windows Defender<\/strong> \u2192 <strong>Operational<\/strong><\/p>\n<figure id=\"attachment_5616\" aria-describedby=\"caption-attachment-5616\" style=\"width: 689px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5616\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-event-log.png\" alt=\"Configure Controlled Folder Access - event log\" width=\"699\" height=\"369\" \/><figcaption id=\"caption-attachment-5616\" class=\"wp-caption-text\">Controlled folder access &#8211;Event log entry<\/figcaption><\/figure>\n<table>\n<thead>\n<tr>\n<th>Event ID<\/th>\n<th>Description<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>5007<\/td>\n<td>Event when settings are changed<\/td>\n<\/tr>\n<tr>\n<td>1124<\/td>\n<td>Audited Controlled folder access event<\/td>\n<\/tr>\n<tr>\n<td>1123<\/td>\n<td>Blocked Controlled folder access event<\/td>\n<\/tr>\n<tr>\n<td>1127<\/td>\n<td>Blocked &#8220;changes to the memory&#8221; event?<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div class=\"qt\">\n<p>There is no official info regarding CFA Event ID: 1127. It could be related to blocked &#8220;making changes to memory&#8221; events. I found an interesting entry in my system.<\/p>\n<pre>Log Name:      Microsoft-Windows-Windows Defender\/Operational\nSource:        Microsoft-Windows-Windows Defender\nDate:          \nEvent ID:      1127\nTask Category: None\nLevel:         Warning\nKeywords:      \nUser:          SYSTEM\nComputer:      DESKTOP-JKJ4G5Q\nDescription:\nControlled Folder Access blocked C:\\Program Files\\JAM Software\\TreeSize\\TreeSize.exe from making changes to memory.\n    Detection time: 2019-04-21T17:17:09.462Z\n    User: DESKTOP-JKJ4G5Q\\ramesh\n    Path: \\Device\\HarddiskVolume2\n    Process Name: C:\\Program Files\\JAM Software\\TreeSize\\TreeSize.exe\n    Signature Version: 1.291.2409.0\n    Engine Version: 1.1.15800.1\n    Product Version: 4.18.1903.4\n<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-9199\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/cfa-blocked-event-1127.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications\" width=\"626\" height=\"438\" \/><\/p>\n<\/div>\n<div class=\"qt\">\n<p>To get the list of the last 25 blocked apps, open a Command Prompt window and run this command-line:<\/p>\n<pre>wevtutil qe \"Microsoft-Windows-Windows Defender\/Operational\" \/q:\"*[System[(EventID=1123)]]\" \/c:15 \/f:text \/rd:true | findstr \/i \"process name:\"<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-9677\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/wevtutil-defender-blocked-list.png\" alt=\"defender controlled folder access - blocked apps list\" width=\"698\" height=\"251\" \/><\/p>\n<p>Also, see the <a href=\"#ps_script_whitelist\">PowerShell script<\/a> at the end of this article to list items in a listview grid window and whitelist selected items in a single click.<\/p>\n<\/div>\n<p>Here is the list of <strong>Unauthorized changes blocked<\/strong>\u00a0notifications, as seen in the Action Center.<\/p>\n<figure id=\"attachment_5617\" aria-describedby=\"caption-attachment-5617\" style=\"width: 690px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5617\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-action-center.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications - blocked apps\" width=\"700\" height=\"530\" \/><figcaption id=\"caption-attachment-5617\" class=\"wp-caption-text\">Action Center notification on blocked apps<\/figcaption><\/figure>\n<p>I allowed the app right away, as Notepad++ is a widely used and trusted program. To allow an app, click <strong>Allow an app through Controlled folder access<\/strong> option in Microsoft Defender Security Center. Then, locate and add the app you want to allow.<\/p>\n<figure id=\"attachment_5614\" aria-describedby=\"caption-attachment-5614\" style=\"width: 691px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5614\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-allow-app-2.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications -- Allowing an app\" width=\"701\" height=\"533\" \/><figcaption id=\"caption-attachment-5614\" class=\"wp-caption-text\">Controlled folder access &#8212; Allowing an app<\/figcaption><\/figure>\n<h3><a id=\"apps_all\"><\/a>Allow recently blocked apps<\/h3>\n<p>The Controlled folder access also lets you allow apps that were <strong>recently blocked<\/strong>. To see the list of apps that are blocked, click on the <strong>Add an allowed app<\/strong> button, and click <strong>Recently blocked apps<\/strong>.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8749\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-recently-blocked-apps-1.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications - allow recently blocked apps - controlled folder access\" width=\"797\" height=\"436\" srcset=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-recently-blocked-apps-1.png 797w, https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-recently-blocked-apps-1-768x420.png 768w\" sizes=\"auto, (max-width: 797px) 100vw, 797px\" \/><\/p>\n<p>You&#8217;ll get the list of apps there were recently blocked. From the list, you can click select an app and add it to the allow list. To do so, you need to click on the <code>+<\/code> glyph icon or button near the app entry.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8750\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-recently-blocked-apps-2.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications - recently blocked apps list - controlled folder access\" width=\"790\" height=\"631\" srcset=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-recently-blocked-apps-2.png 790w, https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-recently-blocked-apps-2-768x613.png 768w\" sizes=\"auto, (max-width: 790px) 100vw, 790px\" \/><\/p>\n<p>Here, I&#8217;ve whitelisted PowerShell.exe process, as an example.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8748\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-recently-blocked-apps-3.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications - allow powershell from recently blocked apps - controlled folder access\" width=\"700\" height=\"477\" \/><\/p>\n<p><em>Make sure you allow only the apps you trust. Allowing PowerShell.exe should be done with extreme caution, as crypto-malware may silently execute a PowerShell command or script on a vulnerable computer.<\/em><\/p>\n<h2><a id=\"manage_ps\"><\/a>Manage Controlled folder access Using PowerShell<\/h2>\n<p>PowerShell&#8217;s <code>Set-MpPreference<\/code> cmdlet supports many parameters so that you can apply every Microsoft Defender setting through script. For the full list of parameters supported by this <a href=\"https:\/\/www.winhelponline.com\/blog\/defender-enable-pua-pup-adware-protection\/\">cmdlet<\/a>, check out <a href=\"https:\/\/docs.microsoft.com\/en-us\/powershell\/module\/defender\/set-mppreference?view=win10-ps\" target=\"_blank\" rel=\"noopener noreferrer\">this Microsoft page<\/a>.<\/p>\n<h3><a id=\"enable_ps\"><\/a>Enable Controlled folder access using PowerShell<\/h3>\n<p>Start <code>powershell.exe<\/code> as administrator. To do so, type <code>powershell<\/code> in the Start menu, right click Windows PowerShell and click Run as administrator.<\/p>\n<p>Enter the following cmdlet:<\/p>\n<pre>Set-MpPreference -EnableControlledFolderAccess Enabled<\/pre>\n<figure id=\"attachment_5611\" aria-describedby=\"caption-attachment-5611\" style=\"width: 691px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5611\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-powershell.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications - controlled folder access powershell cmdlet\" width=\"701\" height=\"127\" \/><figcaption id=\"caption-attachment-5611\" class=\"wp-caption-text\">Manage controlled folder access using PowerShell cmdlet<\/figcaption><\/figure>\n<p>To disable, use this command:<\/p>\n<pre>Set-MpPreference -EnableControlledFolderAccess Disabled<\/pre>\n<h3><a id=\"folders_ps\"><\/a>Protect additional folders using PowerShell<\/h3>\n<pre>Add-MpPreference -ControlledFolderAccessProtectedFolders \"c:\\apps\"<\/pre>\n<h3><a id=\"apps_ps\"><\/a>Allow a specific app (Notepad++) using PowerShell<\/h3>\n<pre>Add-MpPreference -ControlledFolderAccessAllowedApplications \"d:\\tools\\npp\\notepad++.exe\"<\/pre>\n<h3><a id=\"apps_all_ps\"><\/a>Allow all blocked apps to Controlled folder access (interactively) using PowerShell<\/h3>\n<p>Redditor <a title=\"https:\/\/www.reddit.com\/user\/gschizas\" href=\"https:\/\/www.reddit.com\/u\/gschizas\">\/u\/gschizas<\/a> has come up with a neat little PowerShell script which parses the event log (entries with ID: <code>1123<\/code> which is the &#8220;Blocked Controlled folder access&#8221; event) to gather the list of apps blocked by Microsoft Defender&#8217;s Controlled folder access. The script then offers to whitelist all or selected programs from the listing.<\/p>\n<h4><a id=\"ps_script_whitelist\"><\/a>How to use the script?<\/h4>\n<ul>\n<li>Open PowerShell as administrator.<\/li>\n<li>Visit the gschizas <a href=\"https:\/\/gist.github.com\/gschizas\/94f432c68944dfc53414bb4cc7f7a2bb\" target=\"_blank\" rel=\"noopener noreferrer\">GitHub page<\/a><\/li>\n<li>Select all the lines of code and copy to clipboard.<\/li>\n<li>Switch to the PowerShell window and paste the contents there, and press <kbd>ENTER<\/kbd>\n<figure id=\"attachment_5652\" aria-describedby=\"caption-attachment-5652\" style=\"width: 691px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5652\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/powershell-allow-all-apps-cfa.png\" alt=\"allow all apps controlled folder apps using powershell script\" width=\"701\" height=\"732\" \/><figcaption id=\"caption-attachment-5652\" class=\"wp-caption-text\">Allow all apps through Controlled folder apps &#8211;Powershell script<\/figcaption><\/figure>\n<p>The list of blocked apps is shown, as recorded in the event log.<\/p>\n<p><figure id=\"attachment_5651\" aria-describedby=\"caption-attachment-5651\" style=\"width: 691px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5651\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/powershell-allow-all-apps-cfa-2.png\" alt=\"allow all apps controlled folder apps using powershell script\" width=\"701\" height=\"312\" \/><figcaption id=\"caption-attachment-5651\" class=\"wp-caption-text\">Select the apps to whitelist<\/figcaption><\/figure><\/li>\n<li>Select the apps you want to whitelist and click OK. To multi-select programs, press the <kbd>Ctrl<\/kbd> button and click on the corresponding entry.<\/li>\n<li>Click OK.This allows the apps through Controlled folder access <em>en masse<\/em>.\n<p><figure id=\"attachment_5650\" aria-describedby=\"caption-attachment-5650\" style=\"width: 691px\" class=\"wp-caption alignnone\"><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-5650\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/powershell-allow-all-apps-cfa-3.png\" alt=\"allow all apps controlled folder apps\" width=\"701\" height=\"533\" \/><figcaption id=\"caption-attachment-5650\" class=\"wp-caption-text\">Apps added to Controlled folder apps &#8220;Allow&#8221; list<\/figcaption><\/figure><\/li>\n<\/ul>\n<div class=\"qt\">\n<p>In an enterprise environment, Controlled folder access can be managed using:<\/p>\n<ul>\n<li>1. Windows Defender Security Center app<\/li>\n<li>2. <a href=\"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-real-time-protection-virus\/\">Group Policy<\/a><\/li>\n<li>3. PowerShell<\/li>\n<\/ul>\n<\/div>\n<h2><a id=\"trblsht\"><\/a>Troubleshooting: Controlled folder access option missing, grayed out or inaccessible<\/h2>\n<p>When you try to open the Controlled folder access page via Start, you may see this error message:<\/p>\n<pre class=\"err\"><strong>Page not available<\/strong><\/pre>\n<pre class=\"err\">Your IT administrator has limited access to some areas of this app, and the item you tried to access is not available. Contact IT helpdesk for more information.<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8754\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-page-unavailable-1.png\" alt=\"controlled folder access - page not available - it administrator blocked\" width=\"699\" height=\"408\" \/><\/p>\n<p>You may be wondering if the above error is caused by some group policy restrictions in effect on your computer. It may not necessarily be true.<\/p>\n<p>The error occurs if you&#8217;re using a third-party antivirus solution on your computer, which would have turned off the built-in Microsoft Defender. As stated earlier, the <strong>Controlled folder access<\/strong> feature fully relies on Microsoft Defender real-time protection. If Microsoft Defender is turned off, Controlled folder access wouldn&#8217;t work. Hence the page remains inaccessible or grayed out, depending upon the build of Windows 10\/11 you&#8217;re using.<\/p>\n<p>In my case, the error occurred after I installed Malwarebytes Premium. It had replaced Microsoft Defender.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-8753\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/10\/controlled-folder-access-page-unavailable-2.png\" alt=\"controlled folder access option missing\" width=\"375\" height=\"364\" \/><\/p>\n<p><em><strong>Note:<\/strong> If you&#8217;re a Malwarebytes premium user, you can still <strong>enable and use Defender alongside<\/strong> Malwarebytes premium.<\/em><\/p>\n<p>To do so, open Malwarebytes Premium \u2192 Settings \u2192 General \u2192 Turn off <strong>Always register Malwarebytes in the Windows Security Center<\/strong>.<\/p>\n<p>This option ensures that Malwarebytes Premium doesn&#8217;t turn off Microsoft Defender Antivirus. It can run alongside Defender so that the Controlled folder access feature would work as well. After turning off the setting, the Malwarebytes program status wouldn&#8217;t appear in the Windows Security Center.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png\" alt=\"malwarebytes security center register\" width=\"1010\" height=\"713\" class=\"alignnone size-full wp-image-76122\" srcset=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off.png 1010w, https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/mbam-register-wsc-off-768x542.png 768w\" sizes=\"auto, (max-width: 1010px) 100vw, 1010px\" \/><\/p>\n<h2><a id=\"cfa_shortcuts\"><\/a>Enable or disable Controlled folder access using desktop shortcuts<\/h2>\n<p>In some situations, you may need to temporarily disable Controlled Folder Access to allow programs to write to protected folders, without having to\u00a0<a href=\"#apps\">whitelist each program<\/a>.\u00a0For example, you may have whitelisted the ShareX program, but screen captures may still not work because the video capture and processing tool\u00a0<strong>FFMpeg.exe<\/strong>\u00a0is not whitelisted in Controlled Folder Access. And you may not want to allow the external program permanently.<\/p>\n<p>For this purpose, you can create two desktop shortcuts to disable\/enable Controlled Folder Access quickly.<\/p>\n<ol>\n<li>Right-click on the desktop, click New, shortcut<\/li>\n<li>In the &#8220;Type the location of the item&#8221; text box, type the following command:\n<pre>powershell.exe -command \"&amp; {Set-MpPreference -EnableControlledFolderAccess Enabled}\"<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-5945\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/enable-disable-cfa-shortcut.png\" alt=\"enable disable controlled folder access desktop shortcuts\" width=\"614\" height=\"454\" \/><\/li>\n<li>Name the shortcut &#8220;Enable Controlled Folder Access&#8221;.<em><strong>Quick Tip:<\/strong> In the shortcut Properties tab, you may configure it to <strong>run minimized<\/strong> if you don&#8217;t want to see the PowerShell window when the command is executed. Of course, PowerShell.exe need to be <a href=\"#apps\">whitelisted<\/a> in order for these shortcuts to work. PowerShell&#8217;s executable path is <code>C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe<\/code> if you&#8217;re going to whitelist it.<\/em><\/li>\n<li>Similarly, create another shortcut with the following target:\n<pre>powershell.exe -command \"&amp; {Set-MpPreference -EnableControlledFolderAccess Disabled}\"<\/pre>\n<p>Name it as &#8220;Disable Controlled Folder Access&#8221;, and optionally, change the shortcut icon for both the items as desired.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-5944\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/11\/enable-disable-cfa.png\" alt=\"Configure Controlled Folder Access to Stop Unauthorized changes blocked Notifications - enable disable controlled folder access desktop shortcuts\" width=\"248\" height=\"165\" \/><\/li>\n<\/ol>\n<h4>Run as Administrator<\/h4>\n<p>The shortcut\/command has to be run elevated (as administrator). So, right-click each shortcut and click Properties.\u00a0Click Advanced, and enable &#8220;<strong>Run as Administrator<\/strong>&#8221; checkbox, and click OK, OK.<\/p>\n<p>Repeat the step for the other shortcut.<\/p>\n<h2>Closing words<\/h2>\n<p>Microsoft Defender Antivirus is getting a new security feature in almost every Windows 10 build. To name a few, <a href=\"https:\/\/www.winhelponline.com\/blog\/start-windows-defender-offline-scan\/\">Microsoft Defender Offline<\/a> scanner, <a href=\"https:\/\/www.winhelponline.com\/blog\/windows-defender-running-alongside-antivirus-program-limited-periodic-scanning\/\">Limited Periodic Scanning<\/a>, &#8220;<a href=\"https:\/\/www.winhelponline.com\/blog\/defender-block-at-first-sight-cloud-protection\/\">Block at first sight<\/a>&#8221; Cloud-protection and Automatic sample submission, and <a href=\"https:\/\/www.winhelponline.com\/blog\/defender-enable-pua-pup-adware-protection\/\">adware or PUA\/PUP protection<\/a> capability, and <a href=\"https:\/\/www.winhelponline.com\/blog\/windows-defender-application-guard-edge-most-secure-browser\/\">Application Guard<\/a>.<\/p>\n<p>And now <strong>Controlled folder access<\/strong> introduced in the Fall Creators Update is yet another valuable feature to guard the system against threats, such as ransomware.<\/p>\n<h3>Related article<\/h3>\n<ul>\n<li><a href=\"https:\/\/www.winhelponline.com\/blog\/error-file-not-found-save-files-desktop-windows-10-controlled-folder-access\/\">Cannot Save Files to Desktop and Error &#8220;File not found&#8221;.<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Windows 10 and 11 include a beneficial security feature named Controlled folder access, which is part of the Microsoft Defender Exploit Guard. You may have noticed the Unauthorized changes blocked notifications. Microsoft Defender&#8217;s Controlled folder access feature is the one behind those notifications. Controlled folder access helps you protect valuable data from malicious programs, such &#8230; <a title=\"How to Configure Controlled Folder Access to Stop &#8220;Unauthorized changes blocked&#8221; Notifications\" class=\"read-more\" href=\"https:\/\/www.winhelponline.com\/blog\/use-controlled-folder-access-windows-10-windows-defender\/\" aria-label=\"Read more about How to Configure Controlled Folder Access to Stop &#8220;Unauthorized changes blocked&#8221; Notifications\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[8,869],"tags":[116,303,396,661],"class_list":["post-5610","post","type-post","status-publish","format-standard","hentry","category-windows-10","category-windows-11","tag-controlled-folder-access","tag-malwarebytes","tag-powershell","tag-windows-defender"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":8302,"url":"https:\/\/www.winhelponline.com\/blog\/error-file-not-found-save-files-desktop-windows-10-controlled-folder-access\/","url_meta":{"origin":5610,"position":0},"title":"Cannot Save Files to Desktop and Error &#8220;File not found&#8221; in Windows 10","author":"Ramesh","date":"March 26, 2019","format":false,"excerpt":"When you try to save a file on the desktop or the documents folder on your Windows 10 computer, it may show the \"File not found\" error message. Here is the full error message verbatim: Save as C:\\Users\\Ramesh\\Desktop\\filename.txt File not found. Check the file name and try again. .. with\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"unauthorized changes blocked - controlled folder access","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/03\/w10-cfa-blocked-desktop-save-file-1.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":27814,"url":"https:\/\/www.winhelponline.com\/blog\/rufus-error-access-device-denied-0x00000005\/","url_meta":{"origin":5610,"position":1},"title":"Rufus Error: Access to the device is denied [0x00000005]","author":"Ramesh","date":"August 31, 2022","format":false,"excerpt":"When you try to create a bootable USB drive from an ISO using Rufus, you may encounter the Access Denied error. The full error message is below: Error: Access to the device is denied. I received the above error when creating a Ubuntu boot disk from the ISO using Rufus.\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"rufus error access is denied - defender controlled folder access","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/08\/rufus-blocked-defender.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/08\/rufus-blocked-defender.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/08\/rufus-blocked-defender.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":17887,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-identifies-same-threat-repeatedly\/","url_meta":{"origin":5610,"position":2},"title":"Windows Defender Shows the Same Threat Repeatedly. How to Clear the Protection History","author":"Ramesh","date":"August 14, 2020","format":false,"excerpt":"On some Windows 10 and 11 computers, Microsoft Defender Antivirus may repeatedly warn about the same threat, although you've taken the necessary action (remediated) on that threat. When you click \"Start actions\" after choosing \"Remove\", nothing happens. Windows Defender would keep showing that non-existent threat. Cause This is caused by\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"detectionhistory folder contents","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/08\/defender-detection-history-delete.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":5125,"url":"https:\/\/www.winhelponline.com\/blog\/windows-defender-disabled-real-time-protection-virus\/","url_meta":{"origin":5610,"position":3},"title":"Microsoft Defender: &#8220;Managed by your administrator&#8221; or &#8220;Your IT administrator has limited access&#8221;","author":"Ramesh","date":"January 23, 2017","format":false,"excerpt":"In the aftermath of a malware attack, the Windows Defender Security settings page may show the message Some settings are managed by your organization\u00a0or This setting is managed by your administrator. The real-time protection and cloud-based protection options may remain disabled or grayed out. Here is what the Windows Defender\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"Microsoft Defender Antivirus group policy settings","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2017\/01\/windows-defender-gpedit-ui.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":8717,"url":"https:\/\/www.winhelponline.com\/blog\/enable-or-disable-defender-shortcut-command-line\/","url_meta":{"origin":5610,"position":4},"title":"Enable or Disable Windows Defender Using Shortcut or Command-line","author":"Ramesh","date":"April 18, 2019","format":false,"excerpt":"Windows Defender, the built-in anti-virus program in Windows, has useful features such as cloud-based protection, offline scanning, limited periodic scanning, tamper protection, controlled folder access, etc. Almost every aspect of Windows Defender can be managed or automated using the MpCmdrun.exe command-line tool and PowerShell cmdlets. There are times when you\u2026","rel":"","context":"In &quot;Utilities&quot;","block_context":{"text":"Utilities","link":"https:\/\/www.winhelponline.com\/blog\/category\/utilities\/"},"img":{"alt_text":"advancedrun command-line to disable defender","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/04\/advanced-run-command-line-defender.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":4568,"url":"https:\/\/www.winhelponline.com\/blog\/defender-enable-pua-pup-adware-protection\/","url_meta":{"origin":5610,"position":5},"title":"How to Enable Scanning for PUA\/PUP\/Adware in Windows Defender","author":"Ramesh","date":"November 12, 2016","format":false,"excerpt":"Windows Defender can detect and remove malware and viruses, but it doesn't catch Potentially Unwanted Programs or crapware by default. However, there is an opt-in feature that you can enable to make Microsoft Defender antivirus scan and eliminate adware, PUAs, or PUPs in real-time. Potentially Unwanted Program (PUP), Potentially Unwanted\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/windows-defender-header.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/windows-defender-header.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/11\/windows-defender-header.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=5610"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/5610\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=5610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=5610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=5610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}