Manage Ransomware Protection Settings in Windows 11

What Ransomware Protection Includes in 🪟 Windows 11

Ransomware protection is a section of the Windows Security app with two parts. Each handles a different stage of an attack, so it helps to know which one you are adjusting.

Controlled folder access

Controlled folder access watches a set of folders and allows only trusted apps to change files inside them. If ransomware, or any unknown app, tries to modify a protected file, Windows blocks the attempt and shows a notification. Protected folders include the folders in your user profile (the folders Windows sets up for your account), such as Documents, Pictures, Videos, Music, Favorites and Desktop. You can add more.

For a deeper look at whether the feature suits your setup, read Should You Enable Controlled Folder Access in Windows Security Ransomware Protection.

Ransomware data recovery

Ransomware data recovery connects Windows Security to OneDrive (Microsoft’s cloud storage service). If an attack damages files that sync to OneDrive, you can restore earlier versions from the cloud. This part does not stop an attack. It limits the damage afterward.

Which editions get it

Both features appear in Windows Security on Windows 11 Home and Pro. You do not need Group Policy (a tool for managing settings across a PC or network) or Registry Editor (a tool for editing Windows settings directly) to use them. Everything in this guide works from the Windows Security interface.

Before You Start: Why Ransomware Protection Options May Be Missing

If the Ransomware protection section is absent, or its switches are greyed out, one of three conditions is usually the cause. Check these first to save time.

• Another antivirus is active. Controlled folder access belongs to Microsoft Defender Antivirus. When a non-Microsoft antivirus is your main protection, Windows turns Defender’s controls off or hides them. Manage ransomware protection in that product instead, or uninstall it to return control to Windows Security.
• Real-time protection is off. Controlled folder access needs real-time protection (Defender’s constant background scanning) to run. Turn it on under Virus & threat protection settings.
• Your organization manages the PC. On a work or school device, administrators can lock these settings. You then see a message such as “Some of these settings are managed by your organization.” Ask your IT team.

To see the current state of your protection before you change anything, follow How to Check Windows Security Protection Status in Settings.

Also check that you are signed in with an administrator account. A standard account (one without administrator rights) triggers a User Account Control (UAC) prompt that asks for an administrator password. Without it, the change does not apply.

Tamper protection is a related setting that stops apps and malicious code from changing Defender’s settings behind your back. If a change does not stick, see How to Enable Tamper Protection in Windows 11.

Open Ransomware Protection and Turn On Controlled Folder Access

These steps open the settings page and turn on Controlled folder access. Administrator privileges are required for the final steps.

1. Click Start. The Start menu⊞ opens with a search box🔍 at the top.

   

2. Type Windows Security and press Enter. The Windows Security app opens with a left-hand menu. You can also go to Settings › Privacy & security › Windows Security and click Open Windows Security.

   

3. Click Virus & threat protection in the left menu. The page shows scan options and protection settings.

   

4. Scroll down to Ransomware protection. This section sits near the bottom of the page and shows a short description of the feature.

   

5. Click Manage ransomware protection. The Ransomware protection page opens. It lists Controlled folder access at the top and Ransomware data recovery below it.

   

6. Switch Controlled folder access to On. A UAC prompt appears. This step requires administrator privileges.
7. Click Yes in the UAC prompt. If you are on a standard account, enter an administrator password instead. The switch now reads On, and three links appear under it: Block history, Protected folders and Allow an app through Controlled folder access.

If the Manage ransomware protection link is missing, return to the previous section. A third-party antivirus or a managed device is the most likely cause. If wording on your screen differs slightly, look for the same section names, since Microsoft adjusts the Windows Security layout between feature updates.

The protection takes effect immediately. You do not need to restart.

Choose Which Folders Controlled Folder Access Protects

The default folder list covers your user profile locations, but many people keep important files elsewhere, such as a second drive or a project folder. Add those folders so they get the same protection. Administrator privileges are required.

Add a protected folder

1. Open Windows Security and go to Virus & threat protection › Manage ransomware protection. The Ransomware protection page opens.
2. Click Protected folders. A UAC prompt appears.
3. Click Yes to approve the prompt. The list of protected folders opens, with a Add a protected folder button at the top.
4. Click Add a protected folder. A folder picker window opens.

   

5. Select the folder you want to protect and click Select Folder. The folder now appears in the list.

Protect the folder that holds your files, not an entire drive. Protecting a very broad location, such as a whole system drive, raises the chance that Windows blocks legitimate programs.

Remove a protected folder you added

To undo an addition, return to the Protected folders list, click the folder, and then click Remove. Approve the UAC prompt if it appears. Windows stops guarding that folder right away. Windows lists its default folders, but you cannot remove them from the list.

Controlled folder access is separate from the privacy permissions that decide which apps can read your files. For that setting, see How to Manage App Permissions for Documents, Pictures and Videos in Windows 11 Privacy Settings.

Allow a Trusted App Through Controlled Folder Access

Controlled folder access can block safe programs, such as a photo editor, a backup tool or a game that saves to Documents. Add a trusted app to the allowed list so it can write to protected folders again. Administrator privileges are required.

Add an app to the allowed list

1. Open Windows Security and go to Virus & threat protection › Manage ransomware protection. The Ransomware protection page opens.
2. Click Allow an app through Controlled folder access. A UAC prompt appears.
3. Click Yes to approve the prompt. The allowed apps page opens with an Add an allowed app button.
4. Click Add an allowed app. A small menu opens with two choices: Recently blocked apps and Browse all apps.
5. Choose Recently blocked apps if Windows just stopped the program. A list of blocked apps appears. Click the + next to the app to allow it.
6. Choose Browse all apps if the app is not in that list. Find its .exe file in the file picker, select it and click Open. The app now appears on the allowed list.

Try the action that failed again. The app should now save to the protected folder without a block notification.

Remove an allowed app

To take back permission, open the allowed apps list, click the app, and then click Remove. The app is blocked from protected folders again the next time it tries to write there.

Review the Block History

Block history shows every attempt Controlled folder access stopped. It tells you whether a block was a real threat or a trusted app that needs permission. Opening it changes nothing.

1. Open Windows Security and go to Virus & threat protection › Manage ransomware protection. The Ransomware protection page opens.
2. Click Block history. The Protection history page opens.
3. Select an entry marked as a blocked item. The details show the app name, the file it tried to change and the time.
4. Decide what to do. If you do not recognize the app, leave it blocked and run a scan. If you do recognize it, use the allowed apps steps above.

When Windows blocks an app, a notification titled “Unauthorized changes blocked” appears on screen. Clicking that notification is a quick way to reach the same details.

Set Up Ransomware Data Recovery With OneDrive

Ransomware data recovery links your files to OneDrive so you can restore earlier versions if an attack damages them. Windows Security checks whether OneDrive is set up and prompts you if it is not. Setting up OneDrive does not require administrator privileges.

1. Open Windows Security and go to Virus & threat protection › Manage ransomware protection. The Ransomware protection page opens.
2. Find Ransomware data recovery below Controlled folder access. It reports your OneDrive status.
3. Click Set up OneDrive if the button appears. The OneDrive sign-in window opens.
4. Sign in with your Microsoft account and follow the prompts. OneDrive begins syncing the folders you choose.
5. Return to the Ransomware protection page. The section now shows that OneDrive is set up, and a link to manage or view your files appears.

Turn Off Controlled Folder Access or Reverse a Change

Turning off Controlled folder access removes your main defense against ransomware. Turn it off only for a specific reason, such as troubleshooting. Administrator privileges are required.

1. Open Windows Security and go to Virus & threat protection › Manage ransomware protection. The Ransomware protection page opens.
2. Switch Controlled folder access to Off. A UAC prompt appears.
3. Click Yes to approve it. The switch reads Off, and the three links under it disappear.

Your protected folders and allowed apps lists are not erased. To turn protection back on, switch the setting to On. The earlier lists return. For a full walkthrough of turning it on, see Protect Your Data: Enable Ransomware Protection in Windows 11.

Fix Common Problems With Ransomware Protection

The Controlled folder access switch is greyed out

A greyed-out switch usually means your organization manages the setting or another antivirus is in control. Check Windows Security › Virus & threat protection for a message naming the provider. If real-time protection is off, turn it on under Virus & threat protection settings and return to the page.

A trusted program cannot save files

Controlled folder access often blocks programs that fail to save, or that report “access denied” in Documents or Pictures, so check Block history first. Find the app there and allow it as described above. If nothing appears there, something else is probably the cause, such as file permissions (the rules that decide who can change a file).

The UAC prompt keeps asking for a password

This means you are on a standard account. Enter the credentials of an administrator account, or sign in as an administrator and repeat the step.

A setting changes back on its own

On a managed PC, your organization’s policy can change the setting back and override your choice. On a personal PC, check that no other security program is changing Defender’s settings. How to Manage Windows 11 Security and Privacy Settings covers the wider set of controls you may want to review.

What to Do Next

Work as you normally would for a day or two with Controlled folder access on, then check Block history. Add any app you rely on that shows up there. Then confirm that the Windows Security home page shows no warnings for Ransomware protection, and back up important files to a drive that is not always connected.