How to Add or Remove Protected Folders for Controlled Folder Access in Windows 11

Summary

Controlled Folder Access Windows 11 is a Microsoft Defender feature that protects your sensitive files from ransomware and unauthorized apps by blocking untrusted software. Managing your protected folders ensures your important documents stay safe while letting trusted programs run normally.

• Why Use It: Controlled Folder Access protects important files by allowing only trusted apps to access protected folders.
• Default Protection: Several system and user folders are protected by default. This gives you a basic level of security right away.
• Add Your Own Folders: You can add extra folders for protection. But you cannot remove the default folders.
• How to Configure It: You can set up the feature through Windows Security, Command Prompt, Local Group Policy Editor, or Registry Editor.
• Admin Rights Required: You must be signed in as an administrator to add or remove protected folders.
• Watch for Notifications: Pay attention to notifications that show when an untrusted app tries to access protected folders.

By following these steps, you can make your device more secure. You will prevent unauthorized apps from accessing your important files.

Remove Protected Folders

1. Select the Enabled radio button.
2. Click on the Show button next to Enter the folders that should be guarded under Options.
3. Delete the Value name and Value columns for the drives or folders you want to remove.
4. When finished removing drives or folders, click on OK.
5. Click on OK again.

Undo These Changes

To go back to the default setting:

1. Select the Not Configured radio button.
2. Click on OK.
3. You can now close the Local Group Policy Editor.

Option 4Configure Protected Folders Using Registry Editor

Add Protected Folder to Controlled Folder Access

1. REQUIRES ADMIN: Click on the Download button below to download the ⬇️ registry file that adds the needed registry keys and values.
2. REQUIRES ADMIN: Open Registry Editor (regedit.exe).
3. In the left pane, go to this key:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
4. In the right pane of the ProtectedFolders key, right-click on 🖱️ an empty space. Click on New. Click on String Value.
5. Type the full path of the drive or folder you want to add as the name. Example: "Z:\" Press Enter.
6. Double-click on this string value to change it.
7. Type the number 0. Click on OK.

Remove Protected Folder from Controlled Folder Access

1. REQUIRES ADMIN: Open Registry Editor (regedit.exe).
2. In the left pane, go to this key:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
3. In the right pane of the ProtectedFolders key, right-click on 🖱️ the string value (REG_SZ) of the drive or folder you want to remove. Example: "Z:\" Click on Delete.
4. Click on Yes to confirm.
5. When finished removing drives or folders, you can close Registry Editor.

Summary

Controlled Folder Access Windows 11 is a Microsoft Defender feature that protects your sensitive files from ransomware and unauthorized apps by blocking untrusted software. Managing your protected folders ensures your important documents stay safe while letting trusted programs run normally.

• Why Use It: Controlled Folder Access protects important files by allowing only trusted apps to access protected folders.
• Default Protection: Several system and user folders are protected by default. This gives you a basic level of security right away.
• Add Your Own Folders: You can add extra folders for protection. But you cannot remove the default folders.
• How to Configure It: You can set up the feature through Windows Security, Command Prompt, Local Group Policy Editor, or Registry Editor.
• Admin Rights Required: You must be signed in as an administrator to add or remove protected folders.
• Watch for Notifications: Pay attention to notifications that show when an untrusted app tries to access protected folders.

By following these steps, you can make your device more secure. You will prevent unauthorized apps from accessing your important files.

Add Protected Folders

1. Select the Enabled radio button.
2. Click on the Show button next to Enter the folders that should be guarded under Options.
3. In the Value name column, type the full path of the drive or folder you want to add. Example: "Z:\"

   • Double-click in the field to enter the full path.
4. In the Value column to the right, type the number 0.

   • Double-click in the field to enter the number.
5. When finished adding drives or folders, click on OK.
6. Click on OK again.

Remove Protected Folders

1. Select the Enabled radio button.
2. Click on the Show button next to Enter the folders that should be guarded under Options.
3. Delete the Value name and Value columns for the drives or folders you want to remove.
4. When finished removing drives or folders, click on OK.
5. Click on OK again.

Undo These Changes

To go back to the default setting:

1. Select the Not Configured radio button.
2. Click on OK.
3. You can now close the Local Group Policy Editor.

Option 4Configure Protected Folders Using Registry Editor

Add Protected Folder to Controlled Folder Access

1. REQUIRES ADMIN: Click on the Download button below to download the registry file that adds the needed registry keys and values.
2. REQUIRES ADMIN: Open Registry Editor (regedit.exe).
3. In the left pane, go to this key:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
4. In the right pane of the ProtectedFolders key, right-click on an empty space. Click on New. Click on String Value.
5. Type the full path of the drive or folder you want to add as the name. Example: "Z:\" Press Enter.
6. Double-click on this string value to change it.
7. Type the number 0. Click on OK.

Remove Protected Folder from Controlled Folder Access

1. REQUIRES ADMIN: Open Registry Editor (regedit.exe).
2. In the left pane, go to this key:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
3. In the right pane of the ProtectedFolders key, right-click on the string value (REG_SZ) of the drive or folder you want to remove. Example: "Z:\" Click on Delete.
4. Click on Yes to confirm.
5. When finished removing drives or folders, you can close Registry Editor.

Summary

Controlled Folder Access Windows 11 is a Microsoft Defender feature that protects your sensitive files from ransomware and unauthorized apps by blocking untrusted software. Managing your protected folders ensures your important documents stay safe while letting trusted programs run normally.

• Why Use It: Controlled Folder Access protects important files by allowing only trusted apps to access protected folders.
• Default Protection: Several system and user folders are protected by default. This gives you a basic level of security right away.
• Add Your Own Folders: You can add extra folders for protection. But you cannot remove the default folders.
• How to Configure It: You can set up the feature through Windows Security, Command Prompt, Local Group Policy Editor, or Registry Editor.
• Admin Rights Required: You must be signed in as an administrator to add or remove protected folders.
• Watch for Notifications: Pay attention to notifications that show when an untrusted app tries to access protected folders.

By following these steps, you can make your device more secure. You will prevent unauthorized apps from accessing your important files.

Controlled Folder Access in Windows 11 blocks ransomware and unknown apps from changing or deleting personal files stored on your PC. This built-in Microsoft Defender security feature automatically protects default folders like Documents, Pictures, and Videos as soon as you turn it on.

You can add extra folders to this list to keep important games, tax records, and family photos safe from digital threats. Setting up custom protected folders ensures unauthorized software cannot touch your important data without your direct permission.

• C:\Users\<username>\Documents
• C:\Users\Public\Documents
• C:\Users\<username>\Pictures
• C:\Users\Public\Pictures
• C:\Users\Public\Videos
• C:\Users\<username>\Videos
• C:\Users\<username>\Music
• C:\Users\Public\Music
• C:\Users\<username>\Favorites

You can add other folders to protect. But you cannot remove the default folders listed above. You can protect folders, drives, network shares, and mapped drives. Environment variables and wildcards are supported.

Reference:

Customize controlled folder access - Microsoft Defender for Endpoint

Add other folders that should be protected by controlled folder access, or allow apps that are incorrectly blocking changes to important files.

What You Need to Know:

You must be signed in as an administrator to add or remove protected folders for Controlled Folder Access. Controlled Folder Access must be turned on before you can add and remove protected folders.

Option 1Add or Remove Protected Folders Using Windows Security

1. Open Windows Security.
2. Click on Virus & threat protection.

3. Do one of the following:

   • Click on the Manage ransomware protection link under Ransomware protection.
   • Click on the Manage settings link under Virus & threat protection settings. Then click on the Manage Controlled folder access link under Controlled folder access.

Windows Security lets you add or remove protected folders for Controlled Folder Access Windows 11 directly through the antivirus settings menu. Open the app, go to virus and threat protection, and open your ransomware protection settings to choose which specific folders need extra defense against unauthorized apps and ransomware threats.

Windows Security lets you add or remove protected folders for Controlled Folder Access Windows 11 directly through the antivirus settings menu. Open the app, go to virus and threat protection, and open your ransomware protection settings to choose which specific folders need extra defense against unauthorized apps and ransomware threats.

4. Click on the Protected folders link.

Windows Security lets you add or remove protected folders for Controlled Folder Access Windows 11 directly through the antivirus settings menu. Open the app, go to virus and threat protection, and open your ransomware protection settings to choose which specific folders need extra defense against unauthorized apps and ransomware threats.

Add Protected Folders to Controlled Folder Access

1. Click on Add a protected folder.

2. Go to and select the drive or folder you want to add. Click on Select Folder.

Remove Protected Folders from Controlled Folder Access

1. Click on the protected folder you want to remove to open it.
2. Click on Remove.
3. Click on OK to confirm. (See screenshot below)

When you finish adding or removing protected folders, you can close Windows Security.

Option 2Add or Remove Protected Folders Using Command

1. REQUIRES ADMIN: Open Windows Terminal (Admin). Select either Windows PowerShell or Command Prompt.
2. Type the command below into Windows Terminal (Admin). Press Enter.

PowerShell commands let you quickly add or remove folders for Controlled Folder Access Windows 11 without clicking through the graphical settings menu. Open Windows Terminal with administrator rights, then run the correct cmdlet with your file path to update your protected folder list instantly.

PowerShell Add-MpPreference -ControlledFolderAccessProtectedFolders "<full path>"

OR

To remove a protected folder:

PowerShell Remove-MpPreference -ControlledFolderAccessProtectedFolders "<full path>"

Replace <full path> in the commands above with the actual full path of the drive or folder you want to add or remove.

Example:

PowerShell Add-MpPreference -ControlledFolderAccessProtectedFolders "Z:\"

PowerShell Remove-MpPreference -ControlledFolderAccessProtectedFolders "Z:\"

3. When finished, you can close Windows Terminal (Admin).

Option 3Configure Protected Folders Using Local Group Policy Editor

Local Group Policy Editor (gpedit.msc, a built-in tool for managing system settings) lets administrators configure Controlled Folder Access Windows 11 across professional editions of the operating system. Navigate to the Windows Defender Exploit Guard folder in the policy tree to set up your organization rules.

1. REQUIRES ADMIN: Open the Local Group Policy Editor (gpedit.msc).
2. In the left pane, go to this location: (See screenshot below)

   • Computer Configuration › Administrative Templates › Windows Components › Microsoft Defender Antivirus › Microsoft Defender Exploit Guard › Controlled folder access

3. In the right pane under Controlled folder access, double-click on the Configure protected folders policy.

Add Protected Folders

1. Select the Enabled radio button.
2. Click on the Show button next to Enter the folders that should be guarded under Options.
3. In the Value name column, type the full path of the drive or folder you want to add. Example: "Z:\"

   • Double-click in the field to enter the full path.
4. In the Value column to the right, type the number 0.

   • Double-click in the field to enter the number.
5. When finished adding drives or folders, click on OK.
6. Click on OK again.

Remove Protected Folders

1. Select the Enabled radio button.
2. Click on the Show button next to Enter the folders that should be guarded under Options.
3. Delete the Value name and Value columns for the drives or folders you want to remove.
4. When finished removing drives or folders, click on OK.
5. Click on OK again.

Undo These Changes

To go back to the default setting:

1. Select the Not Configured radio button.
2. Click on OK.
3. You can now close the Local Group Policy Editor.

Option 4Configure Protected Folders Using Registry Editor

Add Protected Folder to Controlled Folder Access

1. REQUIRES ADMIN: Click on the Download button below to download the registry file that adds the needed registry keys and values.
2. REQUIRES ADMIN: Open Registry Editor (regedit.exe).
3. In the left pane, go to this key:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
4. In the right pane of the ProtectedFolders key, right-click on an empty space. Click on New. Click on String Value.
5. Type the full path of the drive or folder you want to add as the name. Example: "Z:\" Press Enter.
6. Double-click on this string value to change it.
7. Type the number 0. Click on OK.

Remove Protected Folder from Controlled Folder Access

1. REQUIRES ADMIN: Open Registry Editor (regedit.exe).
2. In the left pane, go to this key:

   • HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders
3. In the right pane of the ProtectedFolders key, right-click on the string value (REG_SZ) of the drive or folder you want to remove. Example: "Z:\" Click on Delete.
4. Click on Yes to confirm.
5. When finished removing drives or folders, you can close Registry Editor.

Summary

Controlled Folder Access Windows 11 is a Microsoft Defender feature that protects your sensitive files from ransomware and unauthorized apps by blocking untrusted software. Managing your protected folders ensures your important documents stay safe while letting trusted programs run normally.

• Why Use It: Controlled Folder Access protects important files by allowing only trusted apps to access protected folders.
• Default Protection: Several system and user folders are protected by default. This gives you a basic level of security right away.
• Add Your Own Folders: You can add extra folders for protection. But you cannot remove the default folders.
• How to Configure It: You can set up the feature through Windows Security, Command Prompt, Local Group Policy Editor, or Registry Editor.
• Admin Rights Required: You must be signed in as an administrator to add or remove protected folders.
• Watch for Notifications: Pay attention to notifications that show when an untrusted app tries to access protected folders.

By following these steps, you can make your device more secure. You will prevent unauthorized apps from accessing your important files.