windows-itpro-docs/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard.md

title, keywords, description, search.product, ms.pagetype, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, ms.localizationpriority, author, ms.author, ms.date, ms.reviewer, manager

title	keywords	description	search.product	ms.pagetype	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	ms.localizationpriority	author	ms.author	ms.date	ms.reviewer	manager
Turn on the protected folders feature in Windows 10	Controlled folder access, windows 10, windows defender, ransomware, protect, files, folders, enable, turn on, use	Learn how to protect your important files by enabling Controlled folder access	eADQiWindows 10XVcnh	security	w10	manage	library	security	medium	levinec	ellevin	05/13/2019		dansimp

Enable controlled folder access

Applies to:

• Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)

Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard. Controlled folder access is included with Windows 10 and Windows Server 2019.

You can enable controlled folder access by using any of these methods:

• Windows Security app
• Microsoft Intune
• Mobile Device Management (MDM)
• System Center Configuration Manager (SCCM)
• Group Policy
• PowerShell

Audit mode allows you to test how the feature would work (and review events) without impacting the normal use of the machine.

Group Policy settings that disable local administrator list merging will override controlled folder access settings. They also override protected folders and allowed apps set by the local administrator through controlled folder access. These policies include:

• Windows Defender Antivirus Configure local administrator merge behavior for lists
• System Center Endpoint Protection Allow users to add exclusions and overrides

For more information about disabling local list merging, see Prevent or allow users to locally modify Windows Defender AV policy settings.

Windows Security app

1. Open the Windows Security app by clicking the shield icon in the task bar or searching the start menu for Defender.

2. Click the Virus & threat protection tile (or the shield icon on the left menu bar) and then click Ransomware protection.

3. Set the switch for Controlled folder access to On.

Note

If controlled folder access is configured with Group Policy, PowerShell, or MDM CSPs, the state will change in the Windows Security app after a restart of the device. If the feature is set to Audit mode with any of those tools, the Windows Security app will show the state as Off.

Intune

1. Sign in to the Azure portal and open Intune.

2. Click Device configuration > Profiles > Create profile.

3. Name the profile, choose Windows 10 and later and Endpoint protection.

4. Click Configure > Windows Defender Exploit Guard > Network filtering > Enable.

5. Type the path to each application that has access to protected folders and the path to any additional folder that needs protection and click Add.

   

   Note

   Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.

6. Click OK to save each open blade and click Create.

7. Click the profile Assignments, assign to All Users & All Devices, and click Save.

MDM

Use the ./Vendor/MSFT/Policy/Config/ControlledFolderAccessProtectedFolders configuration service provider (CSP) to allow apps to make changes to protected folders.

SCCM

1. In System Center Configuration Manager, click Assets and Compliance > Endpoint Protection > Windows Defender Exploit Guard.
2. Click Home > Create Exploit Guard Policy.
3. Enter a name and a description, click Controlled folder access, and click Next.
4. Choose whether block or audit changes, allow other apps, or add other folders, and click Next.

   Note

   Wilcard is supported for applications, but not for folders. Subfolders are not protected. Allowed apps will continue to trigger events until they are restarted.

5. Review the settings and click Next to create the policy.
6. After the policy is created, click Close.

Group Policy

1. On your Group Policy management machine, open the Group Policy Management Console, right-click the Group Policy Object you want to configure and click Edit.

2. In the Group Policy Management Editor go to Computer configuration and click Administrative templates.

3. Expand the tree to Windows components > Windows Defender Antivirus > Windows Defender Exploit Guard > Controlled folder access.

4. Double-click the Configure Controlled folder access setting and set the option to Enabled. In the options section you must specify one of the following:

   • Enable - Malicious and suspicious apps will not be allowed to make changes to files in protected folders. A notification will be provided in the Windows event log

   • Disable (Default) - The Controlled folder access feature will not work. All apps can make changes to files in protected folders.

   • Audit Mode - If a malicious or suspicious app attempts to make a change to a file in a protected folder, the change will be allowed but will be recorded in the Windows event log. This allows you to assess the impact of this feature on your organization.

     

Important

To fully enable controlled folder access, you must set the Group Policy option to Enabled and also select Enable in the options drop-down menu.

PowerShell

1. Type powershell in the Start menu, right-click Windows PowerShell and click Run as administrator.

2. Enter the following cmdlet:

   Set-MpPreference -EnableControlledFolderAccess Enabled
   

You can enable the feature in audit mode by specifying AuditMode instead of Enabled.

Use Disabled to turn the feature off.

Related topics

• Protect important folders with controlled folder access
• Customize controlled folder access
• Evaluate Microsoft Defender ATP