How to Add Folder to Microsoft Defender Controlled folder access in Windows 11


This post shows students and new users steps to add or remove folders to or from controlled folder access with Microsoft Defender Antivirus in Windows 11. Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware.

Microsoft Defender Controlled folder access applies to many system folders and default locations. You can add other folders to be protected, but you cannot remove default folders in the default list.

Adding other folders to controlled folder access can be helpful for cases when you don’t store files in the default Windows libraries, or have changed the default location of your libraries.

You can also specify network shares and mapped drives. Environment variables and wildcards are supported. Controlled folder access is useful in protecting your files and data from ransomware since only trusted apps the services are allowed to access your protected folders.

Below are Windows system default protected folders:

  • C:\Users\<username>\Documents
  • C:\Users\Public\Documents
  • C:\Users\<username>\Pictures
  • C:\Users\Public\Pictures
  • C:\Users\Public\Videos
  • C:\Users\<username>\Videos
  • C:\Users\<username>\Music
  • C:\Users\Public\Music
  • C:\Users\<username>\Favorites

How to add additional folders to Microsoft Defender-controlled folder access in Windows 11

As mentioned above, Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware.

You can add additional folders, network shares, and mapped drives to be protected via controlled folder access to protect against ransomware.

Add additional folders to the controlled access folder:

In the search box on the taskbar, type Windows Security and then select Windows Security in the list of results.

open windows security app

In Windows Security, select Virus & threat protection.

open windows virus and protection

On the Virus & threat protection settings page, under Ransomware protection, select Manage ransomware settings.

windows 11 controlled folder access turn on

Change the Controlled folder access setting to On or Off.

windows 11 turn on controlled access folder

Under, Controlled folder access, click on Protected folders as highlighted below:

Click on Add a protected folder button, navigate to and select the drive or folder you want to add and click on Select Folder.

To remove a folder from the list, select it and click Remove.

How to enable or disable cloud-delivered protection in Group Policy

In Windows 11, open Local Group Policy Editor by clicking on the Start menu and searching for Edit group policy as highlighted below. Under Best match, select Edit group policy to launch Local Group Policy Editor.

windows 11 edit group policy

In the left pane of Local Group Policy Editor, expand the tree: 

Computer Configuration>Administrative Templates>Windows Components>Microsoft Defender Antivirus>Microsoft Defender Exploit Guard>Controlled folder access

In the Controlled Folder Access details pane on the right, local and double-click Configure protected folders.

Set Configure protected folders setting option to Enabled.

In the options section, you must specify one of the following Select Show, and specify each folder that you want to protect.

Specify each folder you want to protect on each line. An example is listed below. Enter the path of the folder under the Value name and the Value data should be 0.

Select OK.

Close Local Group Policy Editor.

That should do it!


This post showed you how to add additional folders to Microsoft Defender Antivirus-controlled folder access in Windows 11. If you find any error above or have something to add, please use the comment form below.