How to Enable and Configure Controlled Folder Access in Windows 11 to Stop Ransomware

Ransomware attacks frequently target user directories, attempting to encrypt personal documents, spreadsheets, photographs, and system backups before demanding an extortion payment. Windows 11 features a built-in defense mechanism called Controlled Folder Access within Microsoft Defender. When enabled, this feature monitors filesystem input/output and blocks untrusted or unverified software from modifying files within designated protected folders.

How Controlled Folder Access Works in Windows 11

Controlled Folder Access works by establishing an allowlist of verified executable files. Applications verified by Microsoft as clean and safe operate normally. However, whenever an unrecognised process, malicious PowerShell script, or suspicious executable attempts to write, rename, or delete files inside protected locations, Windows blocks the operation instantly and logs a security notification.

Default Protected Folders	Custom Protected Locations	Blocked Action Types
Documents, Pictures, Videos, Music, Desktop, and Favourites.	Secondary internal partitions, external backup drives, and network shares.	File modification, bulk renaming, unauthorized encryption, and permanent deletion.

Enabling Controlled Folder Access via Windows Security

Because Controlled Folder Access can occasionally intercept legitimate niche software or development tools, Windows leaves it disabled by default. Enable it manually using the following steps:

1. Click the Start button or press Win + I to launch Settings.
2. Navigate to Privacy & security in the left navigation sidebar.
3. Select Windows Security, then click Open Windows Security.
4. In the dashboard, click Virus & threat protection.
5. Scroll down to the Ransomware protection section and click Manage ransomware protection.
6. Toggle the switch under Controlled folder access to On.
7. When prompted by User Account Control (UAC), click Yes to confirm administrative permission.

Adding Custom Folders to the Protection List

While Windows automatically safeguards core user libraries, you should extend protection to external drives, custom project repositories, or dedicated backup partitions:

1. On the Ransomware protection page, click Protected folders.
2. Click Add a protected folder.
3. In the file explorer dialogue, browse to your target directory (for example, D:\ClientArchive or E:\PhotoVault).
4. Click Select Folder to lock the directory into the monitoring system.

Note: Default system folders cannot be removed from protection, but custom directories can be deleted at any time by selecting them and clicking Remove.

Allowing Trusted Applications Through Controlled Folder Access

Legitimate tools such as photo editors, code compilers, or local backup utilities may occasionally trigger a false positive when saving changes. Grant them an explicit exclusion:

1. Return to Windows Security > Virus & threat protection > Ransomware protection.
2. Click Allow an app through Controlled folder access.
3. Click Add an allowed app.
4. Choose either:
   • Recently blocked apps: Inspects Windows Security event history and allows you to whitelist an app that failed to save with one click.
   • Browse all apps: Manually navigate to the application’s executable file (e.g., C:\Program Files\YourApp\app.exe).
5. Confirm the addition to restore normal saving privileges.

Configuring Controlled Folder Access via PowerShell (For Sysadmins)

IT administrators and advanced users can configure, audit, and deploy Controlled Folder Access across endpoints using administrative PowerShell commands:

Enable Audit Mode (Test Without Blocking)

Audit mode logs security alerts in the Event Viewer without preventing applications from writing to disk. This helps identify benign software before enforcing strict rules:

Set-MpPreference -EnableControlledFolderAccess AuditMode

Enable Full Blocking Mode

Enforce strict blocking on unverified software:

Set-MpPreference -EnableControlledFolderAccess Enabled

Add a Custom Directory via CLI

Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\FinancialData"

Allow an Executable File via CLI

Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Tools\CustomCompiler.exe"

Troubleshooting Common Controlled Folder Access Issues

• “Settings are managed by your administrator”: If the toggle is greyed out, your computer may be connected to an organisation domain or governed by Microsoft Intune policies. Check local Group Policy settings under Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access.
• Frequent “Unauthorised changes blocked” notifications: Check the Windows Protection History panel to identify the process name. Often, background updaters (such as OneDrive or third-party cloud sync clients) require whitelisting after version upgrades.
• Third-party antivirus conflicts: If you use third-party antivirus suites (e.g., Bitdefender, Norton), Windows Defender operates in passive mode, which disables the native Controlled Folder Access toggle in favor of the third-party suite’s ransomware shield.