Privacy and Security Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus in Windows 11


  • Staff
Windows_Security_banner.png

Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats.

Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. In a ransomware attack, your files can get encrypted and held hostage.

Controlled folder access protects your data by checking apps against a list of known, trusted apps. With controlled folder access in place, a notification appears on the computer where an app attempted to make changes to a file in a protected folder.

Controlled folder access works by only allowing trusted apps to access protected folders. Protected folders are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders.

Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the list are prevented from making any changes to files inside protected folders.

Apps are added to the list based upon their prevalence and reputation. Apps that are highly prevalent and that have never displayed any behavior deemed malicious are considered trustworthy. Those apps are added to the list automatically. You can also manually allow apps to give them access to the protected folders.

This tutorial will show you how to enable or disable Controlled Folder Access for Microsoft Defender Antivirus in Windows 11.


You must be signed in as an administrator to turn on/off or enable/disable Controlled Folder Access for Microsoft Defender Antivirus.

Controlled Folder Access requires turning on Real-time Protection.



Contents

  • Option One: Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus in Windows Security
  • Option Two: Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus using Command
  • Option Three: Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus in Local Group Policy Editor
  • Option Four: Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus using REG file





OPTION ONE

Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus in Windows Security


1 Open Windows Security.

2 Click/tap on Virus & threat protection. (see screenshot below)

Microsoft_Defender_Controlled_Folder_Access-1.png

3 Perform one of the following actions below: (see screenshots below)
  • Click/tap on the Manage ransomware protection link under Ransomware protection.
  • Click/tap on the Manage settings link under Virus & threat protection settings, and click/tap on the Manage Controlled folder access link under Controlled folder access.

Microsoft_Defender_Controlled_Folder_Access-2.png
Microsoft_Defender_Controlled_Folder_Access-3.png

4 Turn On or Off (default) Controlled folder access for what you want. (see screenshots below)

Microsoft_Defender_Controlled_Folder_Access-4.png
Microsoft_Defender_Controlled_Folder_Access-5.png

5 If prompted by UAC, click/tap on Yes to approve.

6 You can now close Windows Security if you like.





OPTION TWO

Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus using Command


1 Open Windows Terminal (Admin), and select either Windows PowerShell or Command Prompt.

2 Copy and paste the command below you want to use into Windows Terminal (Admin), and press Enter. (see screenshots below)

(Turn On Controlled Folder Access)
PowerShell Set-MpPreference -EnableControlledFolderAccess Enabled

OR​

(Default - Turn Off Controlled Folder Access)
PowerShell Set-MpPreference -EnableControlledFolderAccess Disabled

3 You can now close Windows Terminal (Admin) if you like.

Microsoft_Defender_Controlled_Folder_Access_command_ON.png

Microsoft_Defender_Controlled_Folder_Access_command_OFF.png






OPTION THREE

Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus in Local Group Policy Editor


The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.

All editions can use Option Four for the same policy.


1 Open the Local Group Policy Editor (gpedit.msc).

2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)

Computer Configuration>Administrative Templates>Windows Components>Microsoft Defender Antivirus>Microsoft Defender Exploit Guard>Controlled folder access

Microsoft_Defender_Controlled_Folder_Access_gpedit-1.png

3 In the right pane of Controlled folder access in the Local Group Policy Editor, double click/tap on the Configure Controlled folder access policy to edit it. (see screenshot above)

4 Do step 5 (always enable), step 6 (disable), or step 7 (default) below for what you want.


5 Always Enable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Select (dot) Enabled. (see screenshot below)​

B) Select Block in the Configure the guard my folders feature drop menu under Options.​

C) Click/tap on OK, and go to step 8 below.​

Microsoft_Defender_Controlled_Folder_Access_gpedit-3.png

6 Disable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Select (dot) Enabled. (see screenshot below)​

B) Select Disable (Default) in the Configure the guard my folders feature drop menu under Options.​

C) Click/tap on OK, and go to step 8 below.​

Microsoft_Defender_Controlled_Folder_Access_gpedit-4.png

7 Default Controlled Folder Access for Microsoft Defender Antivirus

This is the default setting to allow using Option One and Option Two.


A) Select (dot) Not Configured. (see screenshot below)​

B) Click/tap on OK, and go to step 8 below.​

Microsoft_Defender_Controlled_Folder_Access_gpedit-2.png

8 You can now close the Local Group Policy Editor if you like.





OPTION FOUR

Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus using REG file


1 Do step 2 (always enable), step 3 (disable), or step 4 (default) below for what you want.

2 Always Enable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Click/tap on the Download button below to download the file below, and go to step 5 below.​

Always_Enable_Controlled_Folder_Access.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access]
"EnableControlledFolderAccess"=dword:00000001

3 Disable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Click/tap on the Download button below to download the file below, and go to step 5 below.​

Disable_Controlled_Folder_Access.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access]
"EnableControlledFolderAccess"=dword:00000000

4 Default Controlled Folder Access for Microsoft Defender Antivirus

This is the default setting to allow using Option One and Option Two.


A) Click/tap on the Download button below to download the file below, and go to step 5 below.​

Default_Controlled_Folder_Access.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access]
"EnableControlledFolderAccess"=-

5 Save the .reg file to your desktop.

6 Double click/tap on the downloaded .reg file to merge it.

7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

8 You can now delete the downloaded .reg file if you like.


That's it,
Shawn Brink


 

Attachments

  • Windows_Security.png
    Windows_Security.png
    6 KB · Views: 59
  • Disable_Controlled_Folder_Access.reg
    830 bytes · Views: 149
  • Default_Controlled_Folder_Access.reg
    804 bytes · Views: 152
  • Always_Enable_Controlled_Folder_Access.reg
    830 bytes · Views: 157
Last edited:

CharmaineK

Active member
Member
Local time
3:16 PM
Posts
164
Visit site
OS
Win11 22623.891
I have 4 instances of files blocked since last week showing in my Protection History. I filed to those locations previously without issue. I allowed those files and selected OFF for the Controlled Access Folder. I still see the files in the list; however, I have been able to file to those locations now without issue. Why are they still on the list? Plus, when I open Protection History to view Allowed it says no recent items.
 

Attachments

  • Screenshot 2022-11-02 233335.png
    Screenshot 2022-11-02 233335.png
    35.5 KB · Views: 11
  • Screenshot 2022-11-02 233312.png
    Screenshot 2022-11-02 233312.png
    35.2 KB · Views: 11
  • Screenshot 2022-11-02 233249.png
    Screenshot 2022-11-02 233249.png
    35.8 KB · Views: 10
  • Screenshot 2022-11-02 233227.png
    Screenshot 2022-11-02 233227.png
    24.9 KB · Views: 13
  • Screenshot 2022-11-02 233033.png
    Screenshot 2022-11-02 233033.png
    22.6 KB · Views: 12
  • Screenshot 2022-11-02 232736.png
    Screenshot 2022-11-02 232736.png
    22.4 KB · Views: 11
  • Screenshot 2022-11-02 234413.png
    Screenshot 2022-11-02 234413.png
    10.2 KB · Views: 12

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect

Brink

Administrator
Staff member
MVP
Thread Starter
Local time
2:16 PM
Posts
7,560
Visit site
OS
Windows 11 Pro for Workstations
I have 4 instances of files blocked since last week showing in my Protection History. I filed to those locations previously without issue. I allowed those files and selected OFF for the Controlled Access Folder. I still see the files in the list; however, I have been able to file to those locations now without issue. Why are they still on the list? Plus, when I open Protection History to view Allowed it says no recent items.

Hello, :-)

Just to confirm, were you able to remove these folders like below from being protected by Controlled Folder Access?

 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    16 GB (8GBx2) G.SKILL TridentZ DDR4 3200 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    1TB Samsung 980 PRO M.2,
    6TB WD Black WD6001FZWX
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    Linksys EA9500 router,
    Motorola MB8611 cable modem,
    APC SMART-UPS RT 1000 XL - SURT1000XLI,
    Galaxy S20 Ultra 5G phone
  • Operating System
    Windows 11 Pro for Workstations
    Computer type
    Laptop
    Manufacturer/Model
    HP Spectre x360 2in1
    CPU
    i7-1065G7 3.9 GHz
    Memory
    16 GB LPDDR4-3200
    Graphics card(s)
    Intel Iris Plus
    Sound Card
    Intel SST
    Monitor(s) Displays
    13.3" 4K UWVA AMOLED multitouch
    Screen Resolution
    3840 x 2160
    Hard Drives
    512 GB PCIe NVMe M.2 SSD
    Browser
    Google Chrome
    Antivirus
    Windows Defender and Malwarebytes Premium

CharmaineK

Active member
Member
Local time
3:16 PM
Posts
164
Visit site
OS
Win11 22623.891
I selected to allow them. But they are still in the recent list. Also I turned the toggle to ON and now I have to manually select Autosave when I create new documents and some documents won't save to the selected OneDrive location. I have to save to my desktop, open, save as copy to OneDrive. All this since the Win11 update earlier this week.
 

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect

Brink

Administrator
Staff member
MVP
Thread Starter
Local time
2:16 PM
Posts
7,560
Visit site
OS
Windows 11 Pro for Workstations
@CharmaineK,

As a test, see if using option 3 or 4 to disable Controlled Folder Access via policy may stop this for you.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    16 GB (8GBx2) G.SKILL TridentZ DDR4 3200 MHz
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    1TB Samsung 980 PRO M.2,
    6TB WD Black WD6001FZWX
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    Linksys EA9500 router,
    Motorola MB8611 cable modem,
    APC SMART-UPS RT 1000 XL - SURT1000XLI,
    Galaxy S20 Ultra 5G phone
  • Operating System
    Windows 11 Pro for Workstations
    Computer type
    Laptop
    Manufacturer/Model
    HP Spectre x360 2in1
    CPU
    i7-1065G7 3.9 GHz
    Memory
    16 GB LPDDR4-3200
    Graphics card(s)
    Intel Iris Plus
    Sound Card
    Intel SST
    Monitor(s) Displays
    13.3" 4K UWVA AMOLED multitouch
    Screen Resolution
    3840 x 2160
    Hard Drives
    512 GB PCIe NVMe M.2 SSD
    Browser
    Google Chrome
    Antivirus
    Windows Defender and Malwarebytes Premium

CharmaineK

Active member
Member
Local time
3:16 PM
Posts
164
Visit site
OS
Win11 22623.891
I did go into eventviewer to remove the Protection History logs and ran a script but no difference.
 

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect

CharmaineK

Active member
Member
Local time
3:16 PM
Posts
164
Visit site
OS
Win11 22623.891
It may have been the Foxit Pro extension/add for Microsoft Office. It was set to off. I switched it to On and was able to file a document that I wasn't able to this week (unless I allowed it by following the Contolled Access Folder prompts) Will test more documents.
 

Attachments

  • Screenshot_20221108-024424_Chrome.jpg
    Screenshot_20221108-024424_Chrome.jpg
    140.2 KB · Views: 8

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect
Top Bottom