Windows 10 Home - "Unauthorized changes blocked"

Controlled Folder Access is an enterprise-class ransomware protection component, and you shouldn’t let these Unauthorized changes blocked notifications discourage you from using it. Many friendly apps have already been added to the default whitelist and will be allowed through without any hesitation – but less-well-known apps have to be allowed manually. This is actually pretty easy to do, and once you’ve successfully whitelisted an app, it will look simple in retrospect.

https://cloudblogs.microsoft.com/microsoftsecure/2017/10/23/stopping-ransomware-where-it-counts-protecting-your-data-with-controlled-folder-access/

The Unauthorized changes blockednotification is preserved in the notification list until it’s dismissed – so just click on the notification icon at the far right of the notification area and then jot down the file path for the blocked app. Once you've noted the file path; click on the notification – and that will dismiss it and then automatically launch the Allow an app through Controlled folder access window. Then all you have to do is click on the Add an allowed app button (+) and select the app’s executable in the Open dialog. Unfortunately, the TechNet and Windows IT Pro Center documentation doesn’t even bother to mention this handy little shortcut, but this humble Windows Support document actually sums it up quite nicely:

If you see an App is blocked message when you try to use a familiar app, you can simply unblock the app. If this message displays:

1. Write down or take note of the path of the blocked app.
2. Select the message, and then select Add an allowed app.
3. Browse for the program you want to allow access.

https://support.microsoft.com/en-us/help/4012987/windows-10-virus-threat-protection-windows-defender-security-center

The file path in the notification does tend to be truncated – but there’s usually enough of it there to locate the app without any trouble (it’s usually in the Program Files or Program Files (x86) directory). If the file path is truncated to the point where you can’t locate the blocked app in the Open dialog; then open Event Viewer; navigate to the Windows Defender Operational log; and locate the blocking event (Event ID 1123):

1. Right-click on the Start button **** and select Event Viewer.
2. Navigate to Applications and Services > Microsoft > Windows > Windows Defender > Operational
3. Filter for (or just look for): Event ID 1123

We can see from the latest iterations of the AV-Comparatives Real-World Protection Test that Windows Defender only becomes a “real contender” if it’s configured for the maximum level of protection – and Controlled Folder Access is actually an important part of that optimal configuration:

https://answers.microsoft.com/en-us/protect/forum/protect_defender-protect_scanning-windows_10/antivirus-program-in-windows-10/5858bbe7-6891-44ce-be62-dc047bcc17d2

GreginMich

Thank you

Thanks, 

 an  easy to understand & execute answer / resolution !

Nanno

Do your best to tune in the “big picture” here folks: Turning on Controlled Folder Access is Microsoft’s simple answer for resolving the ransomware problem (for people who don’t have good backups, and who don’t want to be burdened with the task of creating some). So from that perspective, turning off Controlled Folder Access is really just a simple way to unresolve the ransomware issue and put your personal files back at risk.

https://www.microsoft.com/en-us/wdsi/threats/ransomware

The Controlled Folder Access demo tool is available here:

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access

The AMTSO Feature Settings Check for Desktop Solutionsshould be able to detect the lack of PUA Protection or Cloud-delivered Protection (which is turned on by default):

https://www.amtso.org/feature-settings-check-for-desktop-solutions/

And we also have a more extensive set of feature checks available at the Windows Defender Antivirus Testground:

https://demo.wd.microsoft.com/?ocid=cx-wddocs-testground

Note that in the Testground Cloud-delivered Protection test, the test file (validatecloud[1].exe) is detected as Trojan:Win32/Skeeyah.A!rfn, which is a little odd, considering that the AMTSO CloudCar Testfile (cloudcar[1].exe) is detected simply as Virus:DOS/EICAR_Test_File.

GreginMich