Glossary
Controlled folder access
A Microsoft Defender Antivirus feature that stops untrusted applications from modifying files in protected folders, limiting ransomware damage.
Controlled folder access is part of Microsoft Defender Antivirus. It protects a list of folders, by default the user's and public Documents, Pictures, Videos and Music plus the user's Favorites (also for system accounts such as LocalService), and the disk's boot sectors, so that only applications Microsoft considers trustworthy, or that an administrator has explicitly allowed, can write to, rename or delete files in them. Any other process attempting a change is blocked and event 1123 is logged in the Windows Defender Operational log (1124 in audit mode). Additional protected folders and allowed applications can be defined through Group Policy, Intune, Configuration Manager or PowerShell.
It limits the damage ransomware and wiper malware can do to user data even when the malicious process runs. It requires Defender Antivirus in active mode with real-time protection. Start in audit mode for a few weeks to find line-of-business tools that legitimately write to protected locations, allow them by path or signature, then switch to block. Treat it as a last layer after application control and attack surface reduction, not a replacement for backups.