Hello everybody!
In this video, I’m going to tell you about controlled folder access: why we need it,
how it works, how it can be enabled and how to set up certain folders for protection.
Controlled folder access is a function of Windows Defender meant to protect user files
from encryption by various ransomware.
According to Microsoft, any executable file is examined by the Windows Defender antivirus
element to see if the application is dangerous or safe.
If such application is rated as malware, it cannot modify any files in the protected folders.
Why we need this function This
function prevents modifying personal folders such as Documents, Pictures, Music, Videos
and Desktop.
As a rule, any program installed on your computer can modify files in these folders.
If you enable this function, only the programs recognized as friendly will be able to make
any changes.
How to enable this function To enable it, go to Settings / Update & Security
/ Windows Defender / Windows Defender Security Center / Virus & threat protection.
In the window that opens, go to “Virus & threat protection settings,” make sure that “Real-time
Protection” is on, and then enable “Controlled folder access.”
When you do that, two new tabs will appear: “Protected folders” and “Allow an app
through “Controlled folder access.”
By default, the protected folders list includes the Documents, Pictures, Videos, Music, Desktop,
and Favorites folders.
You can’t change the default list of directories, but you can add a new folder path manually
by clicking on the plus icon.
In the other tab, “Allow an app through “Controlled folder access” you can add
to the white list an application which was blocked by the Windows Defender as untrusted.
To do it, click the “Add an allowed app” button and choose the path to the program’s
executable file.
If you encounter an “access denied” error when a program tries to access such folders,
you will have to add it into this list, that’s all.
Group policies In Windows 10, you can configure this function
with group policies.
It’s only possible on a Pro version, as it doesn’t work in Windows Home.
To do it, enter “gpedit.msc” into the search field and run it.
In the window that opens, go to Computer Configuration / Administrative Templates / Windows Components
/ Windows Defender / Windows Defender Exploit Guard / Controlled Folder Access.
Open Controlled Folder Access and enable it here.
In the options, you can select the Block option so that untrusted apps won’t be able to
modify or delete files in protected folders, for example, Documents.
Another option is Audit Mode - the apps usually seen as untrusted will be able to modify or
delete files in protected folders.
However, each event will be recorded to Windows event log.
If you choose Disabled, all apps will be able to modify or delete files in protected folders.
You can also configure trusted apps and protected folders.
PowerShell You can also enable and configure Controlled
folder access using PowerShell; to run it, right-click on the Start menu and select Windows
PowerShell (Administrator).
Alternatively, enter “PowerShell” in the search field and run it while holding down
Ctrl + Shift to start it as Administrator.
To turn the function on, enter the following command: Set-MpPreference -EnableControlledFolderAccess
Enabled, and there are three options for this function: enabled, disabled or AuditMode.
To add a folder into the protected list, enter the command Add-MpPreference -ControlledFolderAccessProtectedFolders
“" Add-MpPreference -ControlledFolderAccessProtectedFolders
"< C:\Users\Dmitry\Downloads>" To add an application into the white list,
use this command: Add-MpPreference -ControlledFolderAccessAllowedApplications “<name of the app to be whitelisted, including
the path>" Add-MpPreference -ControlledFolderAccessAllowedApplications
"< C:\Program Files (x86)\Adobe\AuditionCC\Adobe\Adobe Audition CC 2017\ Adobe Audition CC.exe>"
Controlled folder access events In the event log, Windows records any changes
in the settings as well as all cases when events are triggered by AuditMode and Block
options.
By following the logs, you can monitor all changes made to folders and control any suspicious
activities.
Type Event viewer in the Start menu to open the Windows Event Viewer.
In the tab “Custom Views” you can create your own views.
You can also download a ready-made file with settings and import it.
To view Controlled folder access events, download the archive “Exploit Guard Evaluation Package”
from the Microsoft official website; you can find the link in the description.
Extract the file cfa-events.xml to your Desktop: this is the file containing view settings
for Controlled Folder Access.
On the left panel, under Actions, click Import custom view, specify the path to the file
on the desktop, click Open and OK.
After that, Control Folder Access view will open.
You can visit the Microsoft website to read about meanings of all event IDs.
Find the link in the description.
In my case, event ID 5007 means that settings are changed.
That is all for now.
Hit the Like button and subscribe to our channel.
Leave comments to ask questions.
Thank you for watching.
Good luck.