How to Add or Remove Protected Folders for Controlled Folder Access in Windows 11
You can add or remove protected folders for Controlled Folder Access in Windows 11 to enhance your security against ransomware and other threats.
Controlled Folder Access (a security feature) in Microsoft Defender Antivirus shields your important files by stopping unauthorized apps from making changes. It works by checking apps against a trusted list before allowing access to designated protected folders.
Windows 11 typically protects common folders like Documents and Pictures by default. You can also add custom locations, such as external drives or network shares. You can protect up to 1,000 folders this way.
This tutorial shows you how to manage which folders Controlled Folder Access protects, ensuring only approved applications can modify your valuable data.
Go to Windows Security > Virus & threat protection > Manage ransomware protection. Click Protected folders, then Add a protected folder to select new locations or click a listed folder and Remove to delete it.
Option 1Add or Remove Protected Folders Using Windows Security
- Open Windows Security.
- Click on Virus & threat protection.
- Do one of the following:
- Click on the Manage ransomware protection link under Ransomware protection.
- Click on the Manage settings link under Virus & threat protection settings. Then click on the Manage Controlled folder access link under Controlled folder access.
You can add or remove protected folders for Controlled Folder Access right from the Windows Security app, making it easy to control which apps can access your important files.
You can add or remove protected folders for Controlled Folder Access right from the Windows Security app, making it easy to control which apps can access your important files.
- Click on the Protected folders link.
You can add or remove protected folders for Controlled Folder Access right from the Windows Security app, making it easy to control which apps can access your important files.
Add Protected Folders to Controlled Folder Access
- Click on Add a protected folder.
- Go to and select the drive or folder you want to add. Click on Select Folder.
Remove Protected Folders from Controlled Folder Access
- Click on the protected folder you want to remove to open it.
- Click on Remove.
- Click on OK to confirm. (See screenshot below)
When you finish adding or removing protected folders, you can close Windows Security.
Option 2Add or Remove Protected Folders Using Command
- Type the command below into Windows Terminal (Admin). Press Enter.
For those who prefer using commands, you can add or remove protected folders for Controlled Folder Access using Windows Terminal with administrator privileges.
PowerShell Add-MpPreference -ControlledFolderAccessProtectedFolders "<full path>"OR
To remove a protected folder:
PowerShell Remove-MpPreference -ControlledFolderAccessProtectedFolders "<full path>"Replace <full path> in the commands above with the actual full path of the drive or folder you want to add or remove.
Example:
PowerShell Add-MpPreference -ControlledFolderAccessProtectedFolders "Z:\"PowerShell Remove-MpPreference -ControlledFolderAccessProtectedFolders "Z:\"- When finished, you can close Windows Terminal (Admin).
Option 3Configure Protected Folders Using Local Group Policy Editor
If you have Windows 11 Pro, Enterprise, or Education, you can set up protected folders for Controlled Folder Access using the Local Group Policy Editor.
- REQUIRES ADMIN: Open the Local Group Policy Editor (gpedit.msc).
- In the left pane, go to this location: (See screenshot below)
- Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled folder access
- In the right pane under Controlled folder access, double-click on the Configure protected folders policy.
Add Protected Folder to Controlled Folder Access
You can add a protected folder to Controlled Folder Access using a special file that changes Windows settings, but you’ll need administrator permission to do it.- REQUIRES ADMIN: Click on the Download button below to download the registry file that adds the needed registry keys and values.
- REQUIRES ADMIN: Open Registry Editor (regedit.exe).
- In the left pane, go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
- In the right pane of the ProtectedFolders key, right-click on an empty space. Click on New. Click on String Value.
- Type the full path of the drive or folder you want to add as the name. Example:
"Z:\"Press Enter. - Double-click on this string value to change it.
- Type the number 0. Click on OK.
Remove Protected Folder from Controlled Folder Access
To remove a protected folder from Controlled Folder Access using the registry, you need to find the right spot in Windows settings and delete the entry for that folder.- REQUIRES ADMIN: Open Registry Editor (regedit.exe).
- In the left pane, go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
- In the right pane of the ProtectedFolders key, right-click on the string value (REG_SZ) of the drive or folder you want to remove. Example:
"Z:\"Click on Delete. - Click on Yes to confirm.
- When finished removing drives or folders, you can close Registry Editor.
Summary
Controlled Folder Access in Windows is a helpful tool that stops ransomware and other threats by only letting trusted apps open your important files.
- Why Use It: Controlled Folder Access protects important files by allowing only trusted apps to access protected folders.
- Default Protection: Several system and user folders are protected by default. This gives you a basic level of security right away.
- Add Your Own Folders: You can add extra folders for protection. But you cannot remove the default folders.
- How to Configure It: You can set up the feature through Windows Security, Command Prompt, Local Group Policy Editor, or Registry Editor.
- Admin Rights Required: You must be signed in as an administrator to add or remove protected folders.
- Watch for Notifications: Pay attention to notifications that show when an untrusted app tries to access protected folders.
By following these steps, you can make your device more secure. This prevents unauthorized apps from accessing your important files.
Can I turn controlled folder access off?
Windows Security (GUI) method: Use the Windows Security app to quickly enable or disable Controlled Folder Access on a single device by toggling it under Ransomware Protection, provided Microsoft Defender is fully enabled.
Is controlled folder access worth it?
Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It’s especially useful in helping protect against ransomware that attempts to encrypt your files and hold them hostage.
Remove Protected Folders
Removing a protected folder from Controlled Folder Access is done by going back to the same settings where you added it and taking the folder path off the guarded list.- Select the Enabled radio button.
- Click on the Show button next to Enter the folders that should be guarded under Options.
- Delete the Value name and Value columns for the drives or folders you want to remove.
- When finished removing drives or folders, click on OK.
- Click on OK again.
Undo These Changes
To go back to the default setting:
- Select the Not Configured radio button.
- Click on OK.
- You can now close the Local Group Policy Editor.
Option 4Configure Protected Folders Using Registry Editor
Add Protected Folder to Controlled Folder Access
You can add a protected folder to Controlled Folder Access using a special file that changes Windows settings, but you’ll need administrator permission to do it.- REQUIRES ADMIN: Click on the Download button below to download the registry file that adds the needed registry keys and values.
- REQUIRES ADMIN: Open Registry Editor (regedit.exe).
- In the left pane, go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
- In the right pane of the ProtectedFolders key, right-click on an empty space. Click on New. Click on String Value.
- Type the full path of the drive or folder you want to add as the name. Example:
"Z:\"Press Enter. - Double-click on this string value to change it.
- Type the number 0. Click on OK.
Remove Protected Folder from Controlled Folder Access
To remove a protected folder from Controlled Folder Access using the registry, you need to find the right spot in Windows settings and delete the entry for that folder.- REQUIRES ADMIN: Open Registry Editor (regedit.exe).
- In the left pane, go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
- In the right pane of the ProtectedFolders key, right-click on the string value (REG_SZ) of the drive or folder you want to remove. Example:
"Z:\"Click on Delete. - Click on Yes to confirm.
- When finished removing drives or folders, you can close Registry Editor.
Summary
Controlled Folder Access in Windows is a helpful tool that stops ransomware and other threats by only letting trusted apps open your important files.
- Why Use It: Controlled Folder Access protects important files by allowing only trusted apps to access protected folders.
- Default Protection: Several system and user folders are protected by default. This gives you a basic level of security right away.
- Add Your Own Folders: You can add extra folders for protection. But you cannot remove the default folders.
- How to Configure It: You can set up the feature through Windows Security, Command Prompt, Local Group Policy Editor, or Registry Editor.
- Admin Rights Required: You must be signed in as an administrator to add or remove protected folders.
- Watch for Notifications: Pay attention to notifications that show when an untrusted app tries to access protected folders.
By following these steps, you can make your device more secure. This prevents unauthorized apps from accessing your important files.
Can I turn controlled folder access off?
Windows Security (GUI) method: Use the Windows Security app to quickly enable or disable Controlled Folder Access on a single device by toggling it under Ransomware Protection, provided Microsoft Defender is fully enabled.
Is controlled folder access worth it?
Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It’s especially useful in helping protect against ransomware that attempts to encrypt your files and hold them hostage.
Add Protected Folders
Adding a protected folder to Controlled Folder Access means telling Windows exactly which folder or drive you want to keep safe from unauthorized apps.- Select the Enabled radio button.
- Click on the Show button next to Enter the folders that should be guarded under Options.
- In the Value name column, type the full path of the drive or folder you want to add. Example:
"Z:\"- Double-click in the field to enter the full path.
- In the Value column to the right, type the number 0.
- Double-click in the field to enter the number.
- When finished adding drives or folders, click on OK.
- Click on OK again.
Remove Protected Folders
Removing a protected folder from Controlled Folder Access is done by going back to the same settings where you added it and taking the folder path off the guarded list.- Select the Enabled radio button.
- Click on the Show button next to Enter the folders that should be guarded under Options.
- Delete the Value name and Value columns for the drives or folders you want to remove.
- When finished removing drives or folders, click on OK.
- Click on OK again.
Undo These Changes
To go back to the default setting:
- Select the Not Configured radio button.
- Click on OK.
- You can now close the Local Group Policy Editor.
Option 4Configure Protected Folders Using Registry Editor
Add Protected Folder to Controlled Folder Access
You can add a protected folder to Controlled Folder Access using a special file that changes Windows settings, but you’ll need administrator permission to do it.- REQUIRES ADMIN: Click on the Download button below to download the registry file that adds the needed registry keys and values.
- REQUIRES ADMIN: Open Registry Editor (regedit.exe).
- In the left pane, go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
- In the right pane of the ProtectedFolders key, right-click on an empty space. Click on New. Click on String Value.
- Type the full path of the drive or folder you want to add as the name. Example:
"Z:\"Press Enter. - Double-click on this string value to change it.
- Type the number 0. Click on OK.
Remove Protected Folder from Controlled Folder Access
To remove a protected folder from Controlled Folder Access using the registry, you need to find the right spot in Windows settings and delete the entry for that folder.- REQUIRES ADMIN: Open Registry Editor (regedit.exe).
- In the left pane, go to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
- In the right pane of the ProtectedFolders key, right-click on the string value (REG_SZ) of the drive or folder you want to remove. Example:
"Z:\"Click on Delete. - Click on Yes to confirm.
- When finished removing drives or folders, you can close Registry Editor.
Summary
Controlled Folder Access in Windows is a helpful tool that stops ransomware and other threats by only letting trusted apps open your important files.
- Why Use It: Controlled Folder Access protects important files by allowing only trusted apps to access protected folders.
- Default Protection: Several system and user folders are protected by default. This gives you a basic level of security right away.
- Add Your Own Folders: You can add extra folders for protection. But you cannot remove the default folders.
- How to Configure It: You can set up the feature through Windows Security, Command Prompt, Local Group Policy Editor, or Registry Editor.
- Admin Rights Required: You must be signed in as an administrator to add or remove protected folders.
- Watch for Notifications: Pay attention to notifications that show when an untrusted app tries to access protected folders.
By following these steps, you can make your device more secure. This prevents unauthorized apps from accessing your important files.
Can I turn controlled folder access off?
Windows Security (GUI) method: Use the Windows Security app to quickly enable or disable Controlled Folder Access on a single device by toggling it under Ransomware Protection, provided Microsoft Defender is fully enabled.
Is controlled folder access worth it?
Controlled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps. It’s especially useful in helping protect against ransomware that attempts to encrypt your files and hold them hostage.
Was this guide helpful?
About the Author
Richard
Tech Writer, IT Professional
Richard, a writer for Geek Rewind, is a tech enthusiast who loves breaking down complex IT topics into simple, easy-to-understand ideas. With years of hands-on experience in system administration and enterprise IT operations, he’s developed a knack for offering practical tips and solutions. Richard aims to make technology more accessible and actionable. He's deeply committed to the Geek Rewind community, always ready to answer questions and engage in discussions.
No comments yet — be the first to share your thoughts!