deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-06-27 16:23:36 +00:00
Code Issues Actions 3 Packages Projects Releases Wiki Activity

Merge pull request #4422 from MicrosoftDocs/cfa-4720693

Browse Source 
CFA updates
This commit is contained in:
Denise Vangel-MSFT
2020-12-20 06:55:36 -08:00
committed by GitHub
parent 437dd775c8 34d5c1939f
commit 4f6571df54
2 changed files with 43 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
windows/security/threat-protection/microsoft-defender-atp/controlled-folders.md
View File

@ -11,7 +11,7 @@ ms.localizationpriority: medium
author: denisebmsft author: denisebmsft
ms.author: deniseb ms.author: deniseb
audience: ITPro audience: ITPro
ms.date: 12/10/2020 ms.date: 12/17/2020
ms.reviewer: v-maave ms.reviewer: v-maave
manager: dansimp manager: dansimp
ms.custom: asr ms.custom: asr
@ -21,7 +21,6 @@ ms.custom: asr
[!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)] [!INCLUDE [Microsoft 365 Defender rebranding](../../includes/microsoft-defender.md)]
**Applies to:** **Applies to:**
- [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
@ -30,6 +29,9 @@ ms.custom: asr
Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices). Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Supported on Windows Server 2019 and Windows 10 clients, controlled folder access can be turned on using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices).
> [!NOTE]
> Scripting engines are not trusted and you cannot allow them access to controlled protected folders. For example, PowerShell is not trusted by controlled folder access, even if you add it as an application you trust or allow with [certificate and file indicators](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates).
Controlled folder access works best with [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md). Controlled folder access works best with [Microsoft Defender for Endpoint](../microsoft-defender-atp/microsoft-defender-advanced-threat-protection.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](../microsoft-defender-atp/investigate-alerts.md).
## How does controlled folder access work? ## How does controlled folder access work?

80
windows/security/threat-protection/microsoft-defender-atp/customize-controlled-folders.md
View File

@ -8,10 +8,11 @@ ms.mktglfcycl: manage
ms.sitesec: library ms.sitesec: library
ms.localizationpriority: medium ms.localizationpriority: medium
audience: ITPro audience: ITPro
author: levinec author: denisebmsft
ms.author: ellevin ms.author: deniseb
ms.reviewer: ms.reviewer: jcedola, dbodorin, vladiso, nixanm, anvascon
manager: dansimp manager: dansimp
ms.date: 12/16/2020
--- ---
# Customize controlled folder access # Customize controlled folder access
@ -21,53 +22,47 @@ manager: dansimp
**Applies to:** **Applies to:**
* [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631) - [Microsoft Defender for Endpoint](https://go.microsoft.com/fwlink/p/?linkid=2146631)
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019 and Windows 10 clients. Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Controlled folder access is supported on Windows Server 2019 and Windows 10 clients.
This article describes how to customize the following settings of the controlled folder access feature with the Windows Security app, Group Policy, PowerShell, and mobile device management (MDM) configuration service providers (CSPs). This article describes how to customize controlled folder access capabilities, and includes the following sections:
* [Add additional folders to be protected](#protect-additional-folders) - [Protect additional folders](#protect-additional-folders)
* [Add apps that should be allowed to access protected folders](#allow-specific-apps-to-make-changes-to-controlled-folders) - [Add apps that should be allowed to access protected folders](#allow-specific-apps-to-make-changes-to-controlled-folders)
- [Allow signed executable files to access protected folders](#allow-signed-executable-files-to-access-protected-folders)
- [Customize the notification](#customize-the-notification)
> [!WARNING] > [!IMPORTANT]
> Controlled folder access monitors apps for activities that may be malicious. Sometimes it might block a legitimate app from making legitimate changes to your files. > Controlled folder access monitors apps for activities that are detected as malicious. Sometimes, legitimate apps are blocked from making changes to your files. If controlled folder access impacts your organization's productivity, you might consider running this feature in [audit mode](audit-windows-defender.md) to fully assess the impact.
>
> This may impact your organization's productivity, so you may want to consider running the feature in [audit mode](audit-windows-defender.md) to fully assess the feature's impact.
## Protect additional folders ## Protect additional folders
Controlled folder access applies to a number of system folders and default locations, including folders such as **Documents**, **Pictures**, and **Movies**. You can add additional folders to be protected, but you cannot remove the default folders in the default list.
Controlled folder access applies to a number of system folders and default locations, including folders such as Documents, Pictures, and Movies. Adding other folders to controlled folder access can be helpful for cases when you don't store files in the default Windows libraries, or you've changed the default location of your libraries.
You can add additional folders to be protected, but you cannot remove the default folders in the default list. You can also specify network shares and mapped drives. Environment variables and wildcards are supported. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists).
You can use the Windows Security app, Group Policy, PowerShell cmdlets, or mobile device management configuration service providers to add and remove additional protected folders.
Adding other folders to controlled folder access can be useful. Some use-cases include if you don't store files in the default Windows libraries, or you've changed the location of the libraries away from the defaults.
You can also enter network shares and mapped drives. Environment variables and wildcards are supported. For information about using wildcards, see [Use wildcards in the file name and folder path or extension exclusion lists](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-antivirus/configure-extension-file-exclusions-microsoft-defender-antivirus#use-wildcards-in-the-file-name-and-folder-path-or-extension-exclusion-lists).
You can use the Windows Security app or Group Policy to add and remove additional protected folders.
### Use the Windows Security app to protect additional folders ### Use the Windows Security app to protect additional folders
1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Defender**. 1. Open the Windows Security app by selecting the shield icon in the task bar or searching the start menu for **Security**.
2. Select **Virus & threat protection**, and then scroll down to the **Ransomware protection** section.
2. Click the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then scroll down to the **Ransomware protection** section. 3. Select **Manage ransomware protection** to open the **Ransomware protection** pane.
3. Click the **Manage ransomware protection** link to open the **Ransomware protection** pane. 4. Under the **Controlled folder access** section, select **Protected folders**.
4. Under the **Controlled folder access** section, click the **Protected folders** link. 5. Choose **Yes** on the **User Access Control** prompt. The **Protected folders** pane displays.
5. Click **Yes** on the **User Access Control** prompt. The **Protected folders** pane displays.
4. Click **Add a protected folder** and follow the prompts to add folders.
4. Select **Add a protected folder** and follow the prompts to add folders.
### Use Group Policy to protect additional folders ### Use Group Policy to protect additional folders
1. On your Group Policy management computer, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. 1. On your Group Policy management computer, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)?preserve=true), right-click the Group Policy Object you want to configure, and then and select **Edit**.
2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. 2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
@ -78,15 +73,15 @@ You can use the Windows Security app or Group Policy to add and remove additiona
### Use PowerShell to protect additional folders ### Use PowerShell to protect additional folders
1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator** 1. Type **powershell** in the Start menu, right-click **Windows PowerShell** and select **Run as administrator**
2. Enter the following cmdlet: 2. Enter the following cmdlet:
```PowerShell ```PowerShell
Add-MpPreference -ControlledFolderAccessProtectedFolders "<the folder to be protected>" Add-MpPreference -ControlledFolderAccessProtectedFolders "<the folder to be protected>"
``` ```
3. Repeat step 2 until you have added all the folders you want to protect. Folders that are added are visible in the Windows Security app.
Continue to use `Add-MpPreference -ControlledFolderAccessProtectedFolders` to add more folders to the list. Folders added using this cmdlet will appear in the Windows Security app. ![Screenshot of a PowerShell window with the cmdlet above entered](../images/cfa-allow-folder-ps.png)
![Screenshot of a PowerShell window with the cmdlet above entered](../images/cfa-allow-folder-ps.png)
> [!IMPORTANT] > [!IMPORTANT]
> Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list. > Use `Add-MpPreference` to append or add apps to the list. Using the `Set-MpPreference` cmdlet will overwrite the existing list.
@ -100,8 +95,7 @@ Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersList](https://docs.m
You can specify if certain apps are always considered safe and give write access to files in protected folders. Allowing apps can be useful if a particular app you know and trust is being blocked by the controlled folder access feature. You can specify if certain apps are always considered safe and give write access to files in protected folders. Allowing apps can be useful if a particular app you know and trust is being blocked by the controlled folder access feature.
> [!IMPORTANT] > [!IMPORTANT]
> By default, Windows adds apps that it considers friendly to the allowed list—apps added automatically by Windows are not recorded in the list shown in the Windows Security app or by using the associated PowerShell cmdlets. > By default, Windows adds apps that are considered friendly to the allowed list. Such apps that are added automatically are not recorded in the list shown in the Windows Security app or by using the associated PowerShell cmdlets. You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness.
> You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness.
When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders. If the app (with the same name) is in a different location, it will not be added to the allow list and may be blocked by controlled folder access. When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders. If the app (with the same name) is in a different location, it will not be added to the allow list and may be blocked by controlled folder access.
@ -109,9 +103,9 @@ An allowed application or service only has write access to a controlled folder a
### Use the Windows Defender Security app to allow specific apps ### Use the Windows Defender Security app to allow specific apps
1. Open the Windows Security by selecting the shield icon in the task bar or searching the start menu for **Defender**. 1. Open the Windows Security app by searching the start menu for **Security**.
2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then select **Ransomware protection**. 2. Select the **Virus & threat protection** tile (or the shield icon on the left menu bar) and then select **Manage ransomware protection**.
3. Under the **Controlled folder access** section, select **Allow an app through Controlled folder access** 3. Under the **Controlled folder access** section, select **Allow an app through Controlled folder access**
@ -121,7 +115,7 @@ An allowed application or service only has write access to a controlled folder a
### Use Group Policy to allow specific apps ### Use Group Policy to allow specific apps
1. On your Group Policy management device, open the [Group Policy Management Console](https://technet.microsoft.com/library/cc731212.aspx), right-click the Group Policy Object you want to configure and select **Edit**. 1. On your Group Policy management device, open the [Group Policy Management Console](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc731212(v=ws.11)?preserve=true), right-click the Group Policy Object you want to configure and select **Edit**.
2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**. 2. In the **Group Policy Management Editor**, go to **Computer configuration** and select **Administrative templates**.
@ -155,12 +149,16 @@ An allowed application or service only has write access to a controlled folder a
Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders. Use the [./Vendor/MSFT/Policy/Config/Defender/GuardedFoldersAllowedApplications](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-defender#defender-guardedfoldersallowedapplications) configuration service provider (CSP) to allow apps to make changes to protected folders.
## Allow signed executable files to access protected folders
Microsoft Defender for Endpoint certificate and file indicators can allow signed executable files to access protected folders. For implementation details, see [Create indicators based on certificates](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/indicator-certificates).
## Customize the notification ## Customize the notification
For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Windows Security](../windows-defender-security-center/windows-defender-security-center.md#customize-notifications-from-the-windows-defender-security-center). For more information about customizing the notification when a rule is triggered and blocks an app or file, see [Configure alert notifications in Microsoft Defender for Endpoint](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-email-notifications).
## Related topics ## See also
* [Protect important folders with controlled folder access](controlled-folders.md) - [Protect important folders with controlled folder access](controlled-folders.md)
* [Enable controlled folder access](enable-controlled-folders.md) - [Enable controlled folder access](enable-controlled-folders.md)
* [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md) - [Evaluate attack surface reduction rules](evaluate-attack-surface-reduction.md)