Privacy and Security Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus in Windows 11


  • Staff
Windows_Security_banner.png

This tutorial will show you how to enable or disable Controlled Folder Access for Microsoft Defender Antivirus in Windows 11.

Microsoft Defender Antivirus is an antivirus software that is included in Windows 11 and can help protect your device from viruses, malware, and other threats.

Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. In a ransomware attack, your files can get encrypted and held hostage.

Controlled folder access protects your data by checking apps against a list of known, trusted apps. With controlled folder access in place, a notification appears on the computer where an app attempted to make changes to a file in a protected folder.

Controlled folder access works by only allowing trusted apps to access protected folders. Protected folders are specified when controlled folder access is configured. Typically, commonly used folders, such as those used for documents, pictures, downloads, and so on, are included in the list of controlled folders.

Controlled folder access works with a list of trusted apps. Apps that are included in the list of trusted software work as expected. Apps that are not included in the list are prevented from making any changes to files inside protected folders.

Apps are added to the list based upon their prevalence and reputation. Apps that are highly prevalent and that have never displayed any behavior deemed malicious are considered trustworthy. Those apps are added to the list automatically. You can also manually allow apps to give them access to the protected folders.


You must be signed in as an administrator to turn on/off or enable/disable Controlled Folder Access for Microsoft Defender Antivirus.

Controlled Folder Access requires turning on Real-time Protection.



Contents

  • Option One: Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus in Windows Security
  • Option Two: Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus using Command
  • Option Three: Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus in Local Group Policy Editor
  • Option Four: Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus using REG file





OPTION ONE

Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus in Windows Security


1 Open Windows Security.

2 Click/tap on Virus & threat protection. (see screenshot below)

Microsoft_Defender_Controlled_Folder_Access-1.png

3 Perform one of the following actions below: (see screenshots below)
  • Click/tap on the Manage ransomware protection link under Ransomware protection.
  • Click/tap on the Manage settings link under Virus & threat protection settings, and click/tap on the Manage Controlled folder access link under Controlled folder access.

Microsoft_Defender_Controlled_Folder_Access-2.png
Microsoft_Defender_Controlled_Folder_Access-3.png

4 Turn On or Off (default) Controlled folder access for what you want. (see screenshots below)

Microsoft_Defender_Controlled_Folder_Access-4.png
Microsoft_Defender_Controlled_Folder_Access-5.png

5 If prompted by UAC, click/tap on Yes to approve.

6 You can now close Windows Security if you like.





OPTION TWO

Turn On or Off Controlled Folder Access for Microsoft Defender Antivirus using Command


1 Open Windows Terminal (Admin), and select either Windows PowerShell or Command Prompt.

2 Copy and paste the command below you want to use into Windows Terminal (Admin), and press Enter. (see screenshots below)

(Turn On Controlled Folder Access)
PowerShell Set-MpPreference -EnableControlledFolderAccess Enabled

OR​

(Default - Turn Off Controlled Folder Access)
PowerShell Set-MpPreference -EnableControlledFolderAccess Disabled

3 You can now close Windows Terminal (Admin) if you like.

Microsoft_Defender_Controlled_Folder_Access_command_ON.png

Microsoft_Defender_Controlled_Folder_Access_command_OFF.png






OPTION THREE

Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus in Local Group Policy Editor


The Local Group Policy Editor is only available in the Windows 11 Pro, Enterprise, and Education editions.

All editions can use Option Four for the same policy.


1 Open the Local Group Policy Editor (gpedit.msc).

2 Navigate to the policy location below in the left pane of the Local Group Policy Editor. (see screenshot below)

Computer Configuration>Administrative Templates>Windows Components>Microsoft Defender Antivirus>Microsoft Defender Exploit Guard>Controlled folder access

Microsoft_Defender_Controlled_Folder_Access_gpedit-1.png

3 In the right pane of Controlled folder access in the Local Group Policy Editor, double click/tap on the Configure Controlled folder access policy to edit it. (see screenshot above)

4 Do step 5 (always enable), step 6 (disable), or step 7 (default) below for what you want.


5 Always Enable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Select (dot) Enabled. (see screenshot below)​

B) Select Block in the Configure the guard my folders feature drop menu under Options.​

C) Click/tap on OK, and go to step 8 below.​

Microsoft_Defender_Controlled_Folder_Access_gpedit-3.png

6 Disable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Select (dot) Enabled. (see screenshot below)​

B) Select Disable (Default) in the Configure the guard my folders feature drop menu under Options.​

C) Click/tap on OK, and go to step 8 below.​

Microsoft_Defender_Controlled_Folder_Access_gpedit-4.png

7 Default Controlled Folder Access for Microsoft Defender Antivirus

This is the default setting to allow using Option One and Option Two.


A) Select (dot) Not Configured. (see screenshot below)​

B) Click/tap on OK, and go to step 8 below.​

Microsoft_Defender_Controlled_Folder_Access_gpedit-2.png

8 You can now close the Local Group Policy Editor if you like.





OPTION FOUR

Enable or Disable Controlled Folder Access for Microsoft Defender Antivirus using REG file


1 Do step 2 (always enable), step 3 (disable), or step 4 (default) below for what you want.

2 Always Enable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Click/tap on the Download button below to download the file below, and go to step 5 below.​

Always_Enable_Controlled_Folder_Access.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access]
"EnableControlledFolderAccess"=dword:00000001

3 Disable Controlled Folder Access for Microsoft Defender Antivirus

This will disable and prevent using Option One and Option Two.


A) Click/tap on the Download button below to download the file below, and go to step 5 below.​

Disable_Controlled_Folder_Access.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access]
"EnableControlledFolderAccess"=dword:00000000

4 Default Controlled Folder Access for Microsoft Defender Antivirus

This is the default setting to allow using Option One and Option Two.


A) Click/tap on the Download button below to download the file below, and go to step 5 below.​

Default_Controlled_Folder_Access.reg


(Contents of REG file for reference)
Code:
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access]
"EnableControlledFolderAccess"=-

5 Save the .reg file to your desktop.

6 Double click/tap on the downloaded .reg file to merge it.

7 When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

8 You can now delete the downloaded .reg file if you like.


That's it,
Shawn Brink


 

Attachments

  • Windows_Security.png
    Windows_Security.png
    6 KB · Views: 119
  • Disable_Controlled_Folder_Access.reg
    830 bytes · Views: 302
  • Default_Controlled_Folder_Access.reg
    804 bytes · Views: 300
  • Always_Enable_Controlled_Folder_Access.reg
    830 bytes · Views: 328
Last edited:
I have 4 instances of files blocked since last week showing in my Protection History. I filed to those locations previously without issue. I allowed those files and selected OFF for the Controlled Access Folder. I still see the files in the list; however, I have been able to file to those locations now without issue. Why are they still on the list? Plus, when I open Protection History to view Allowed it says no recent items.
 

Attachments

  • Screenshot 2022-11-02 233335.png
    Screenshot 2022-11-02 233335.png
    35.5 KB · Views: 71
  • Screenshot 2022-11-02 233312.png
    Screenshot 2022-11-02 233312.png
    35.2 KB · Views: 76
  • Screenshot 2022-11-02 233249.png
    Screenshot 2022-11-02 233249.png
    35.8 KB · Views: 58
  • Screenshot 2022-11-02 233227.png
    Screenshot 2022-11-02 233227.png
    24.9 KB · Views: 63
  • Screenshot 2022-11-02 233033.png
    Screenshot 2022-11-02 233033.png
    22.6 KB · Views: 78
  • Screenshot 2022-11-02 232736.png
    Screenshot 2022-11-02 232736.png
    22.4 KB · Views: 66
  • Screenshot 2022-11-02 234413.png
    Screenshot 2022-11-02 234413.png
    10.2 KB · Views: 66

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect
I have 4 instances of files blocked since last week showing in my Protection History. I filed to those locations previously without issue. I allowed those files and selected OFF for the Controlled Access Folder. I still see the files in the list; however, I have been able to file to those locations now without issue. Why are they still on the list? Plus, when I open Protection History to view Allowed it says no recent items.

Hello, :-)

Just to confirm, were you able to remove these folders like below from being protected by Controlled Folder Access?

 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    APC SMART-UPS RT 1000 XL - SURT1000XLI,
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    HP Spectre x360 2in1 14-eu0098nr (2024)
    CPU
    Intel Core Ultra 7 155H 4.8 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Graphics card(s)
    Integrated Intel Arc
    Sound Card
    Poly Studio
    Monitor(s) Displays
    14" 2.8K OLED multitouch
    Screen Resolution
    2880 x 1800
    Hard Drives
    2 TB PCIe NVMe M.2 SSD
    Internet Speed
    Intel Wi-Fi 7 BE200 (2x2) and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender and Malwarebytes Premium
I selected to allow them. But they are still in the recent list. Also I turned the toggle to ON and now I have to manually select Autosave when I create new documents and some documents won't save to the selected OneDrive location. I have to save to my desktop, open, save as copy to OneDrive. All this since the Win11 update earlier this week.
 

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect
@CharmaineK,

As a test, see if using option 3 or 4 to disable Controlled Folder Access via policy may stop this for you.
 

My Computers

System One System Two

  • OS
    Windows 11 Pro for Workstations
    Computer type
    PC/Desktop
    Manufacturer/Model
    Custom self build
    CPU
    Intel i7-8700K 5 GHz
    Motherboard
    ASUS ROG Maximus XI Formula Z390
    Memory
    64 GB (4x16GB) G.SKILL TridentZ RGB DDR4 3600 MHz (F4-3600C18D-32GTZR)
    Graphics Card(s)
    ASUS ROG-STRIX-GTX1080TI-O11G-GAMING (11GB GDDR5X)
    Sound Card
    Integrated Digital Audio (S/PDIF)
    Monitor(s) Displays
    2 x Samsung Odyssey G75 27"
    Screen Resolution
    2560x1440
    Hard Drives
    1TB Samsung 990 PRO M.2,
    4TB Samsung 990 PRO M.2,
    8TB WD MyCloudEX2Ultra NAS
    PSU
    Seasonic Prime Titanium 850W
    Case
    Thermaltake Core P3 wall mounted
    Cooling
    Corsair Hydro H115i
    Keyboard
    Logitech wireless K800
    Mouse
    Logitech MX Master 3
    Internet Speed
    1 Gbps Download and 35 Mbps Upload
    Browser
    Google Chrome
    Antivirus
    Microsoft Defender and Malwarebytes Premium
    Other Info
    Logitech Z625 speaker system,
    Logitech BRIO 4K Pro webcam,
    HP Color LaserJet Pro MFP M477fdn,
    APC SMART-UPS RT 1000 XL - SURT1000XLI,
    Galaxy S23 Plus phone
  • Operating System
    Windows 11 Pro
    Computer type
    Laptop
    Manufacturer/Model
    HP Spectre x360 2in1 14-eu0098nr (2024)
    CPU
    Intel Core Ultra 7 155H 4.8 GHz
    Memory
    16 GB LPDDR5x-7467 MHz
    Graphics card(s)
    Integrated Intel Arc
    Sound Card
    Poly Studio
    Monitor(s) Displays
    14" 2.8K OLED multitouch
    Screen Resolution
    2880 x 1800
    Hard Drives
    2 TB PCIe NVMe M.2 SSD
    Internet Speed
    Intel Wi-Fi 7 BE200 (2x2) and Bluetooth 5.4
    Browser
    Chrome and Edge
    Antivirus
    Windows Defender and Malwarebytes Premium
I did go into eventviewer to remove the Protection History logs and ran a script but no difference.
 

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect
It may have been the Foxit Pro extension/add for Microsoft Office. It was set to off. I switched it to On and was able to file a document that I wasn't able to this week (unless I allowed it by following the Contolled Access Folder prompts) Will test more documents.
 

Attachments

  • Screenshot_20221108-024424_Chrome.jpg
    Screenshot_20221108-024424_Chrome.jpg
    140.2 KB · Views: 58

My Computer

System One

  • OS
    Win11 22623.891
    Computer type
    Laptop
    Manufacturer/Model
    HP
    CPU
    11th Gen Intel R Core TM i7 - 1165G7 @ 2.80GHz
    Memory
    16gb
    Graphics Card(s)
    Intel R Iris R Xe Graphics
    Sound Card
    Realtek R Audio, Intel Smart Sound
    Hard Drives
    C
    Browser
    Google
    Antivirus
    Windows Security/Microsoft Defender
    Other Info
    Downloaded MSEdgeRedirect
Back
Top Bottom