Controlled Folder Access

You have to go specifically allow the programs to write to those folders.  It's a bit annoying, yes. For most casual users, it's (in my opinion) not ready for ease of use.  I wrote about this and other struggles under Windows Defender Controlled Folder Access is promising protection from ransomware, but implementation can put users in a panic.

CFA is a new Windows Defender anti-ransomware feature, and if you don’t feel that you need ransomware protection, then you can just follow the steps in this article to turn off CFA:

https://support.microsoft.com/en-ph/help/4046851/windows-10-controlled-folder-access-windows-defender-security-center

However, that Microsoft article is purporting to tell you how to:

“Add an app to the list of safe or allowed apps to prevent them from being blocked.” 

When in fact it's only providing the steps for turning off CFA – which will allow your friendly apps access to your folders to be sure; but will also allow access for any unfriendly apps, malware, ransomware, or data wipers – so it’s important to understand how logically distorted this particular article is. The Microsoft article that actually describes how to allow a blocked app through CFA is right here:

https://support.microsoft.com/en-us/help/4012987/windows-10-virus-threat-protection-windows-defender-security-center

When you see one of these Unauthorized Changes Blocked notifications; follow these simple steps to allow the program through Controlled Folder Access:

1. Click on the notifications icon at the far right in the taskbar.

2. Write down the file path provided in the notification.

3. Click on the notification, and then on the Add button (+).

4. Navigate to the file identified in the notification, and then select and “open” it.

The file path in the Unauthorized Changes Blocked notification tends to be truncated – although there’s usually enough of it there to locate the app without any trouble if you just assume that it’s in the Program Files or Program Files (x86) directory. If the file path is truncated to the point where you can’t locate the blocked app in the file-picker dialog; then open Event Viewer; navigate to the Windows Defender Operational log; and locate the blocking event (Event ID 1123):

1. Right-click on the Start button and select Event Viewer.

2. Navigate to Applications and Services > Microsoft > Windows > Windows Defender > Operational

3. Filter for (or just look for): Event ID 1123

Generally speaking, CFA should be turned off whenever you’re installing any new application, and then turned back on again once the installation is complete.

More information is availabe here:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/windows-defender-is-blocking-too-much-saying-it/83a1d803-c687-4ddc-800b-5bb53c6151d1 

If CFA starts blocking apps when you haven’t enabled it, then this might be the effect of a compatibility bug that seems to be activating CFA in the presence of some third-party AV apps. In this case, the first thing to try would be disabling the third-party AV to see if this activates Windows Defender. If so, then toggle CFA on, and then back off again – and then enable the third-party AV in order to turn Defender back off. If that doesn’t work, then you’ll probably have to uninisall and then reinstall the third-party AV app.

Additionally, some third-party AV apps that are capable or running in tandem with Defender (in its real-time mode) might cause problems with CFA. For example, we’re not sure if the anti-exploit protection packaged with Malwarebytes Premium is fully compatible with Windows Defender’s CFA.

If CFA is acting erratically in the absence of any third-party AV app, then follow these troubleshooting steps

1. Remove any undetected malware by scanning with several third-party malware-removal apps, starting with Malwarebytes Free:

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning-windows_other/list-of-malware-removal-tools/d824b9af-ebd8-4c47-94e2-8ee6c544c100

2. Remove any antimalware remnants by running the cleanup utilities for any preinstalled or previously installed AV apps:

https://answers.microsoft.com/en-us/protect/forum/protect_other-protect_start-windows_other/list-of-anti-malware-product-removal-tools/2bcb53f7-7ab4-4ef9-ab3a-6aebfa322f75

3. Run the standard Windows 10 system integrity checks:

https://answers.microsoft.com/en-us/windows/forum/windows_10-update/system-file-check-sfc-scan-and-repair-system-files/bc609315-da1f-4775-812c-695b60477a93

GreginMich

If it takes this much explaining, it isn't ready for the typical mass consumer. 

If it takes this much explaining, it isn't ready for the typical mass consumer. 

CFA is generally pretty easy to maintain; but like any new security feature, there’s a bit of a learning curve, and some bugs that need to be worked out (and documented). Fortunately, I can’t be held accountable for introducing these features, or for any bugs, or for problems with their learning curve – or for providing support for anyone who wants to reinforce their security by applying these new features – since that’s what the V&M forum is here for. CFA is disabled by default, and as I’ve explained above, the easy fix for CFA issues is to just turn it off (with the exception of the bug where it gets stuck in the “on” position). The irony is that all of these off-by-default Exploit Guard features have a learning curve that pales in comparison to the on-by-default Exploit Protection feature.

So I don’t really have any solution for your “it isn't ready for the typical mass consumer” issue, and since it’s very unlikely that Microsoft is going to recall these features based on negative feedback, the best I can do here is just to pave the way for people who might want to try them.

GreginMich

Yup, I 100% agree and feel the exact same way.  That's why I wrote that post about it, hoping to help others achieve it if they are willing to put in the time and drawbacks and have a willing to overcome the issues.

Still a bit strange though  that Microsoft's own programs, delivered with a standard Windows installation, are being blocked, isn't it? Seems to me like a basic first check to do before you introduce a feature. Or is this (potentially very useful) feature designed for very very very specific situations and configurations?

I think if they did that, they'd be asking for trouble.

1)  People would complain that Microsoft gives their own programs special treatment

2)  Everyone would know that the built-in programs aren't as secure, so attackers would focus on exploiting those programs to bypass the filter.

...which sort of makes the feature eternally useless, then. You can't expect users to keep manually whitelisting bonafide programs and Windows' own features all the time. 

By the way, Microsoft Office doesn't get blocked so with your reasoning they already give their own programs "special treatment". Funny thing is, apparently they consider Word safe but not the Snipping tool (just giving hackers a hint where to go...).

Yeah I agree, it's nowhere near ready for a typical consumer to use.  I even ranted about it myself at Windows Defender Controlled Folder Access is promising protection from ransomware, but implementation would drive users insane.

Please see:

https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/?source=mmpc

and discussion:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_start-windows_10/controlled-folder-access-feature-in-windows-10/2812685c-9bb4-4ef6-bad7-cd185f309532  (also)