If you need to add additional folders for protection, click on the ‘+’ next to Add a protected folder. As you can see, CFA also protects default VM shared folders. I set this up on a Windows 10 virtual machine that shares folders with its host. This brings up the window shown in Step 6.Ħ This is a helpful list of folders protected by default. Windows Defender Security Center implementationĢ Under the “Turn Windows Security on or off” tab, select Open Windows Security settings.Ĥ Select Manage Controlled folder access.ĥ Turn on Controlled folder access. Security teams can then review the logs and add additional approved applications to prevent business operation interruptions. When in audit mode, CFA logs application attempts to change files in protected folders but does not block these actions. Regardless of the approach, organizations should always consider first implementing CFA in audit mode. We’ll take a look at three methods: Windows Defender Security Center configuration, use of PowerShell and configuration of group policy. Like most Windows security configurations, how you approach implementing CFA depends on the size of your organization and how you manage CFA policy exceptions. As described later in this article, not knowing what works is a good reason to enable audit mode when first enabling CFA.

I was unable to find a definitive list of what is or is not allowed. This includes Microsoft Office applications and other major vendor products. Microsoft writes that all commonly trusted applications can still make changes to the protected folders. Instead, it is an opt-in feature that requires the implementation of Windows Defender Antivirus real-time protection.

Malware can still read and copy files in those folders.ĬFA is not enabled by default.

It prevents executable files, scripts and DLLs from making changes to files in the protected folders. How CFA worksĪccording to Chris Hoffman, writing for How-To Geek, CFA is primarily intended to protect against ransomware.

Deployed as part of Windows Defender, CFA can prevent malicious applications installed by users from encrypting files in folders identified by Microsoft and the organization. Controlled folder access (CFA) prevents untrusted applications from making changes to essential folders.

Protected folder access blocked