Should You Enable Controlled Folder Access in Windows Security Ransomware Protection

The Hidden Downsides: Why You Should Think Twice

Everyday users should think twice before enabling this feature. It often blocks safe apps from saving their settings, stops some games from launching, and prevents photo editors from exporting files. The aim is to stop ransomware, but the side effect is a steady stream of blocked apps that you have to fix by hand.

Some users report spending significant time tracking down blocked apps and adding them to exception lists. Some people have even reported that standard Windows programs like Notepad or Paint were blocked until they adjusted their settings.

How to Enable and Test Controlled Folder Access Safely

The safest way to try the feature is audit mode first. In audit mode, Windows watches your apps and records what it would have blocked, but it does not stop anything. You get a clear picture of which of your daily programs would run into trouble before you turn on full protection.

The Windows Security app gives you only an on/off switch. Audit mode is not a button there. It is set through policy tools such as Group Policy, Intune or PowerShell. PowerShell is the practical choice on a single PC, and it needs administrator rights.

To switch to audit mode with PowerShell:

1. Right-click the Start button and choose Terminal (Admin). Approve the User Account Control prompt. A window opens with a PowerShell prompt.
2. Type Set-MpPreference -EnableControlledFolderAccess AuditMode and press Enter. If the command returns no message, it worked. If you see an access denied error, the window is not running as administrator.

That’s it. Controlled Folder Access now records what it would have blocked without stopping anything. To go back, run the same command with Enabled for full protection, or Disabled to turn the feature off.

If you only want to turn the full feature on, use the steps below.

To turn on Controlled Folder Access through the Windows Security app:

1. Click the Start button, type Windows Security, and press Enter. The security dashboard opens.
2. Click Virus & threat protection in the left-hand menu.
3. Scroll down to the Ransomware protection section and click Manage ransomware protection. You should now see the ransomware settings page.
4. Find Controlled folder access and click the switch to turn it on. Approve the User Account Control prompt if one appears. The switch should now read On.

That’s it. Controlled Folder Access is now protecting your Documents, Pictures, Desktop and other default folders. No restart is needed, and the feature works the same on Windows 11 Home and Pro.

To undo it, return to the same page and switch it Off. If the switch is greyed out, another antivirus product is probably handling protection, real-time protection is off, or an administrator is managing the setting by policy.

Once the feature is on, you will meet blocked apps sooner or later. Windows shows a notification in Windows Security when it blocks something. The Controlled folder access page also has a Block history link that lists what was blocked, and you can allow an app from there. This is quicker than digging through Event Viewer.

To allow a blocked app:

1. Open Windows Security and go to Windows Security › Virus & threat protection › Manage ransomware protection.
2. Click Allow an app through Controlled folder access under the Controlled folder access switch. Approve the User Account Control prompt. The list of allowed apps opens.
3. Click Add an allowed app. Choose Recently blocked apps to pick from programs that were just stopped, or Browse all apps to find the program file yourself.
4. Select the app and confirm. The app should now appear in the allowed list.

That’s it. The app can now change files in your protected folders. Expect to repeat this after some updates, because a new version can count as a new app. To remove an app later, select it in the allowed list and remove it.

You can also guard more than the default folders. On the same page, click Protected folders, approve the prompt, click Add a protected folder, and choose the folder. Folders on other drives work too. Add only locations that hold data you care about, since every extra folder means more blocked apps.

On a network of computers, IT administrators can set up Controlled Folder Access rules centrally with tools like Microsoft Intune or Configuration Manager. For home users and small offices, turning it on means being patient and watching closely for blocked apps, especially in the first few weeks.

How to Track Down Problems Using Event Viewer

When a pop-up notification does not tell you enough, Event Viewer shows exactly which safe programs were blocked and when. This built-in diagnostic tool helps you find the root cause on a standard standalone PC so you can fix broken apps quickly. The same events are logged under Applications and Services Logs › Microsoft › Windows › Windows Defender › Operational.

To make the ransomware logs easier to read, you can import a custom view into Event Viewer. A custom view is a saved filter that shows only the events you care about. It is an XML file that you create yourself from a trusted source.

Copy the XML from Microsoft’s page into Notepad. Choose Save as, set Save as type to All files, and save it as an XML file so Windows does not add a .txt ending. Then import it with the steps below.

1. Click the Start button, type Event Viewer, and press Enter.
2. Find the Actions pane (on the right side by default) and click Import Custom View. A file browser opens.
3. Browse to the location where you saved your cfa-events.xml file and select it.
4. Click OK to finish importing the view. The new view should now appear under Custom Views in the left-hand panel.

That’s it. Event Viewer now has a saved view of Controlled Folder Access activity, so you can open it any time. To remove it, right-click the view under Custom Views and delete it.

Controlled Folder Access events use two IDs. Event ID 1124 shows audited actions, meaning something that was allowed but recorded. Event ID 1123 shows items that were blocked. Each event tells you which program tried to touch which folder, which helps you decide whether to add that program to your allowed apps list.

Summary

Controlled Folder Access protects your personal files from ransomware by blocking unknown programs from changing your data. It can also block safe apps and lead to a lot of troubleshooting. Security experts recommend testing it in audit mode first, watching your event logs for blocked programs, and managing your allowed app list carefully so it does not cause computer problems.