Controlled Folder Access Blocked problem in Windows Defender

Hi Nsmth,

In this thread, on march 25, GreginMich gave excellent advice regarding this

problem. You should go back and read his post.

I don't understand why so many are having a problem with Controlled Folder

Access. GreginMich offers an approach, that should address just about any

problem that there could be with this feature.

However, getting the path for the App that you want to allow, is sometimes

truncated in the notification on the taskbar. That may be contributing to the

difficulty that some are experiencing. The full path for an App that is flagged

by controlled folder access can be found in the Event Viewer.

Open the Event Viewer, and navigate to Windows Defender "Operational.

"Applications and Service Logs" >Microsoft >Windows >Windows Defender

>Operational.   Scan the log for Event ID 1123 or 1127. If the log is too big

to see either of these right away, you can click on "Create Custom View" on

the right side of the screen. Click "All Event IDs" and enter 1123,1127. Click OK

and also click OK on the next screen. You should see just these IDs now.

Right click on the line for one, and click "Event Properties". In the Properties

screen, you will find the full path displayed. If you have several different Apps

that are being blocked, repeat this action on the other entries, and find their

path as well. Use the paths to allow their processes to pass through Controlled

Folders Access, as you have done before. 

Regards,  Glen

Hi Fahd,

On the Ransomeware protection screen, below the Controlled folder access button,

there is an option, "Allow an app through Controled folder access". If you select that

option, you can allow an app to pass thru Controled folder access.

Click on  +  "Add an allowed app". When you do, it opens Explorer for you. You

can navigate to the app that you want to allow, click on it, and click "open".

Example: Navigate to C: > Program Files > CCleaner > CCleaner64  (the application).

Click on CCleaner64, and "open.

The application will be added to allowed apps list, and Controlled folder access will

let it through. Much better to do it this way. Turning the feature OFF, takes away some

of your built in protection.

Regards,  Glen

Except that is not always the case. I receive the notification on iexplore (which i've allowed), rundll32 (which i've allowed), excel, and word (both of which i've allowed.) outside of iexplore, the others are recent blocks. Others i've allowed no longer are blocked but the fact that Microsoft generated items are being blocked regularly is strange.

Hi Ronald,

The Controlled folder access is a feature of Windows Defender that reviews the apps that can make changes to files in protected folders. You can turn off this feature by following the steps below:

1. Click Start then select Settings.
2. Choose Update & security and select Windows Security/Defender.
3. Select Open Windows Defender Security Center.
4. Select Virus & threat protection, and then choose Virus & threat protection settings.
5. Under Controlled folder access, turn it on or off.

You can also use this article about Windows Defender Security Center on how you can use it to protect your device.

Let me know if you have any other questions.

It sounds like the same problems I was having.  I couldn't save files, download anything, said it couldn't find a file when saving, etc.  Turning off the Controlled Folder Access in Windows Defender solved all the problems.

The problem was most likely just that Controlled Folder Access was turned on. Turning off Windows Defender’s real-time protection also turns off Controlled Folder Access, since CFA requires real-time protection in order to monitor and block Folder Access events (or flag them, if it’s set to Audit Mode). So just turning off CFA (in the Virus & Threat Protection Settings), will eliminate most installation issues; and that’s what’s been recommended so far by most of the application developers. But it’s possible that other components of Defender’s real-time protection might cause issues with the installation of some apps – so turning off real-time protection might be the way to go if you don’t want to risk having to repeat an installation.

But if you haven’t already done so, you should try turning Windows Defender’s real-time protection back on – and then just make sure that CFA is turned off, since that's really what was blocking things. That’s presuming that you’re running Malwarebytes Premium, which includes its own real-time ransomware protection.

GreginMich