Windows 10 Home - "Unauthorized changes blocked"

Wish this had worked for me - found that it did not -

Went through all the steps to add Adobe Photoshop Elements 18 - followed your instructions to get the complete path - after trying 3 times to get Defender to allow me to save changes I made to a photo in Photoshop Elements 18, I was not successful.  

Also, it seems unable to whitelist an entire program - It seems to want you to allow each of the programs individual functions each time you try to use it (download photos from camera, change and save a photo, etc.)

I would have thought that the entire Adobe Photoshop, Elements and Premier programs would have been automatically white listed!

Thank you for trying!

Wish this had worked for me - found that it did not -

Went through all the steps to add Adobe Photoshop Elements 18 - followed your instructions to get the complete path - after trying 3 times to get Defender to allow me to save changes I made to a photo in Photoshop Elements 18, I was not successful.  

Also, it seems unable to whitelist an entire program - It seems to want you to allow each of the programs individual functions each time you try to use it (download photos from camera, change and save a photo, etc.)

I would have thought that the entire Adobe Photoshop, Elements and Premier programs would have been automatically white listed!

Thank you for trying!

Thank you for trying, Amma904. I was speaking primarily to the general audience, since the answer here is most assuredly not the answer for everyone who sees one of these “Unauthorized changes blocked” messages; and since it fails utterly to put the issue in the proper perspective. Issues with friendly apps being blocked can generally be resolved by simply allowing unrecognized apps through Controlled Folder Access with the method described in the documentation.

So turning off Controlled Folder Access is not the generic and unqualified answer for blocked apps, as others have pointed out previously in this thread. Issues with this feature were fully anticipated – and that’s why it was provided with an Audit Mode, which allows users to monitor folder access activity without having anything blocked. Then Controlled Folder Access can be turned back on again once the issues have been worked out, or once the default list of authorized apps has been updated:

Right-click on the Start button and select Windows PowerShell (Admin); and then copy, paste, and enter this command:

Set-MpPreference -EnableControlledFolderAccess AuditMode

https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/evaluate-controlled-folder-access

Or if Audit Mode isn’t your cup of tea, then simply leave Controlled Folder Access turned off for the time being and then try turning it back on again later – or just make sure that everything is properly backed up on a disconnected drive, and then don’t worry about Controlled Folder Access.

https://cloudblogs.microsoft.com/microsoftsecure/2017/03/28/world-backup-day-is-as-good-as-any-to-back-up-your-data/?source=mmpc

GreginMich

I think the feature is a great contribution to security and I'm willing to work with it to get it setup but it's blocking some Microsoft tools:-

Format, ieuinit, ILC.exe to name a few. Presumably there's a white list somewhere and clearly we don't want it to be easy to modify but surely MS have put there own applications on it already?

The audit mode feature looks like a good way forward but will it provide me a list of blocked programmes so I can allow them? - where?

Hopefully they’re still busy building up that default whitelist and things will get better as time goes by. But I think some people are actually having problems with apps that have already been whitelisted, maybe due to some kind of system corruption. Audit events are logged in the Window Defender Operational log in Event Viewer with Event ID 1124, and you can use a Custom View to track them:

1. Right-click on the Start button **** and select Event Viewer.
2. Navigate to Applications and Services > Microsoft > Windows > Windows Defender > Operational
3. In the Actions pane, click on Filter Current Log…
4. Enter “1124” **** for the Event ID (or “1123, 1124” if you’re going back and forth between modes) and click OK.
5. In the Actions Pane, click on Save Filter to Custom View…
6. Name the Custom View “Audit events” (or whatever), and click OK.

Then just click on “Audit events” in the Navigation pane when you go back.

GreginMich