Controlled folder access: ransomware protection that works

Ransomware has one job at the end of an intrusion: rewrite as many files as possible, as fast as possible. Controlled folder access (CFA) attacks that step directly. It lets only trusted applications modify files in a set of protected folders; everything else is blocked, whatever rights the process has.

The Defender hardening pillar recommends it "selectively" because of support tickets. This guide shows how to reduce those tickets to a manageable level through audit, allowlisting and staged enforcement, so you can use it much more widely. For the term itself, see controlled folder access.

How it works

• Scope. A set of protected folders: by default the user and public Documents, Pictures, Videos and Music, plus the user's Favorites (in their redirected location if they are redirected, for example by OneDrive Known Folder Move). Desktop is not in the default list. You can add more, not remove the defaults.
• Trust. Applications Defender considers trustworthy are allowed automatically. You add others by full path.
• Action. When an untrusted process tries to change a file in a protected folder, the write is blocked (or logged, in audit mode) and the user sees a notification.
• Disk sectors. CFA can also block untrusted writes to disk sectors, which some wipers and bootkits use. This has its own modes so you can enable it separately.

Requirements: any Windows 10 or 11 edition that includes Defender Antivirus, or Windows Server 2012 R2 or later (2012 R2 and 2016 through the modern unified solution), with Microsoft Defender Antivirus in active mode and real-time protection on. It does not work in passive mode, EDR in block mode or limited periodic scanning.

The modes

"Disk modification only" modes protect sectors without protecting folders. They are a low-friction first step for servers and devices where folder protection is not yet realistic.

Step 1: audit on a representative group

In Group Policy: Computer Configuration > Policies > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access > Configure Controlled folder access = Enabled, Audit Mode.

In Intune: Endpoint security > Attack surface reduction > Attack surface reduction rules profile, setting Enable Controlled Folder Access = Audit mode (CSP Defender/EnableControlledFolderAccess).

On a lab machine:

Set-MpPreference -EnableControlledFolderAccess AuditMode

Choose the audit group deliberately: at least one device from every department, every build image, and the power users with unusual software (engineering, design, finance with add-ins). Two to four weeks of normal work is enough to see monthly tasks.

Step 2: read the events

CFA logs to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational:

Each event includes the process path and the target file. Group by process across devices to build your allowlist candidates:

Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-Windows Defender/Operational'; Id = 1124 } |
  ForEach-Object {
    if ($_.Message -match 'Process Name:\s*(.+)') { $Matches[1].Trim() }
  } | Group-Object | Sort-Object Count -Descending | Select-Object Count, Name

With Defender for Endpoint, query the whole fleet at once:

DeviceEvents
| where ActionType in ("ControlledFolderAccessViolationAudited", "ControlledFolderAccessViolationBlocked")
| summarize Devices = dcount(DeviceId), Events = count() by InitiatingProcessFolderPath, InitiatingProcessFileName
| order by Devices desc

Typical results: in-house tools, older installers, portable apps in user profiles, backup and sync agents from smaller vendors, scanners and label printers that save to Documents, and games.

Step 3: allow what is legitimate

For each candidate, decide:

• Legitimate and should write there → allow by full path.
• Legitimate but running from a user-writable folder (%LOCALAPPDATA%, Downloads) → install it properly under Program Files first, then allow that path. Allowing a path users can write to lets malware drop a file of the same name.
• Not legitimate or unknown → leave it blocked and investigate.

GPO: Controlled Folder Access > Configure allowed applications = Enabled, with one full executable path per line (value 0). Intune: Controlled Folder Access Allowed Applications (CSP Defender/ControlledFolderAccessAllowedApplications). PowerShell:

Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Contoso\LabelPrint\labelprint.exe"

Defender for Endpoint can also allow signed applications with an Allow certificate or file indicator. Script engines such as PowerShell are the exception: CFA doesn't trust them through indicators, only as an explicitly allowed app. Record an owner for each allowed app, just like Defender exclusions, because an allowed app is an exclusion by another name.

Step 4: add the folders that matter

Default folders cover personal files. Add the places where your organisation actually keeps valuable data locally:

Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Projects", "C:\Finance"

GPO: Controlled Folder Access > Configure protected folders; Intune: Controlled Folder Access Protected Folders. Consider OneDrive sync roots if Known Folder Move is not in use, local project folders on engineering workstations and application data stores on kiosk devices. Network paths and mapped drives can be added, but the protection applies to local processes writing to them.

Step 5: enforce by ring and lock it

Move to Block in rings: IT, then the audit group, then department by department. Keep reading event 1123 after each step; the first days after a ring goes live reveal what the audit missed.

Stop users disabling it or allowing apps themselves. With the setting managed by GPO or Intune, the Windows Security toggle is greyed out. Make sure Tamper Protection is on and local admin merge for lists is disabled, so allowed apps added locally with Add-MpPreference are ignored.

What breaks

• Save failures without clear errors. Old applications often show "access denied" or silently fail. Users see a Windows Security toast, but not always. Tell the service desk to check event 1123 first for any "can't save to Documents" ticket.
• Installers and updaters that write to the public Documents, Pictures, Music or Videos folders.
• Scripts run by user-installed interpreters writing to protected folders.
• Folder redirection: if Documents points to a network share, confirm the redirected location is protected the way you expect, and add it explicitly if not.

A runbook for the service desk

Most CFA tickets look like something else: "Excel can't save", "the scanner lost my files", "the export button does nothing". Give the service desk a short runbook before the first enforcement ring:

1. Ask for the time of the failure and the application used.
2. Check the device for event 1123 around that time. The event names the blocked process and the file it tried to write.
3. If the process is a known business application installed under Program Files, raise a change to add it to the allowed applications policy. Do not add it locally; with local merge disabled it would be ignored anyway.
4. If the process runs from a user profile, the Downloads folder or a temporary path, escalate to security instead of allowing it.
5. As a workaround while the change goes through, the user can save to a non-protected folder and move the file later.

Track these tickets as a category. The volume after each ring tells you whether the audit phase was long enough, and a sudden rise on one device can be the first sign of something trying to encrypt files.

What it does not do

CFA is a last line against local encryption, not a ransomware strategy. It does not stop data theft (reads are allowed), encryption of shares by a remote machine, or an attacker who has already disabled Defender. It complements ASR rules such as Use advanced protection against ransomware, offline backups and recovery-key hygiene for BitLocker.

Verify it

$p = Get-MpPreference
$p.EnableControlledFolderAccess              # 1 = Enabled (block), 2 = Audit
$p.ControlledFolderAccessProtectedFolders
$p.ControlledFolderAccessAllowedApplications
(Get-MpComputerStatus).AMRunningMode          # must be Normal

For a functional test on a pilot device, run a small unsigned test executable from a temporary folder that tries to write a file into Documents. The write should fail, the user should see a notification, and event 1123 should name the process and target. Disk-sector events are logged separately in the same log: 1127 (sector write blocked) and 1128 (audited).

Checklist

• Defender AV active with real-time protection on all target devices
• CFA in audit mode on a representative group for 2 to 4 weeks
• Events 1124 grouped by process; allowlist built from full Program Files paths
• Extra protected folders added where valuable local data lives
• Enforced by ring; event 1123 reviewed after each ring
• Local override blocked; Tamper Protection on; event 5007 alerted
• Disk-sector protection at least in block-disk-only mode on servers