Windows 10: Add or Remove Allowed Apps for Controlled Folder Access in Windows 10

How to: Add or Remove Allowed Apps for Controlled Folder Access in Windows 10

How to Add or Remove Allowed Apps through Controlled Folder Access in Windows 10


Starting with Controlled folder access is introduced in Windows Defender Antivirus.

When Controlled folder access is turned on, it helps you protect valuable data from malicious apps and threats, such as ransomware. It is part of Windows Defender Exploit Guard.

You can specify if certain apps should always be considered safe and given write access to files in protected folders. Allowing apps can be useful if you're finding a particular app that you know and trust is being blocked by the Controlled folder access feature.

By default, Windows adds apps that it considers friendly to the allowed list - apps added automatically by Windows are not recorded in the list shown in the Windows Defender Security Center app. You shouldn't need to add most apps. Only add apps if they are being blocked and you can verify their trustworthiness.

When you add an app, you have to specify the app's location. Only the app in that location will be permitted access to the protected folders - if the app (with the same name) is located in a different location, then it will not be added to the allow list and may be blocked by Controlled folder access.

For more details about Controlled folder access, see:

• Help prevent ransomware and threats from encrypting and changing files | Microsoft Docs
• See how CFA can help protect files from being changed by malicious apps | Microsoft Docs
• Turn on the protected folders feature in Windows 10 | Microsoft Docs
• Add additional folders and apps to be protected by Windows 10 | Microsoft Docs
• Stopping ransomware where it counts: Protecting your data with Controlled folder access Microsoft Secure

This tutorial will show you how to add and remove if specific apps are allowed through the Controlled folder access feature of Windows Defender Exploit Guard in Windows 10.

*Warning You must be signed in as an administrator to add or remove an allowed app through Controlled folder access.


CONTENTS:

• Option One: Add an Allowed App through Controlled Folder Access in Windows Defender Security Center
• Option Two: Remove Allowed App from Controlled Folder Access in Windows Defender Security Center
• Option Three: Add an Allowed App through Controlled Folder Access in PowerShell
• Option Four: Remove Allowed App from Controlled Folder Access in PowerShell
• Option Five: Configure Allowed Apps Policy for Controlled Folder Access in Local Group Policy Editor
• Option Six: Configure Allowed Apps Policy for Controlled Folder Access in Registry Editor

EXAMPLE: Windows Defender Exploit Guard Controlled Folder Access








OPTION ONE [/i] Add an Allowed App through Controlled Folder Access in Windows Defender Security Center

*note The list of allowed apps is stored in the registry key below.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications
1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon. (see screenshot below)



2. Click/tap on the Manage ransomware protection link under the Ransomware protection section. (see screenshot below)



3. Click/tap on the Allow an app through Controlled folder access link. (see screenshot below)



4. Click/tap on Yes when prompted by UAC to approve.

5. Click/tap on Add an allowed app, and click/tap on Browse all apps (build 17704 and later). (see screenshot below)

*note Starting with Windows 10 build 17704, when an app is blocked, it will appear in a recently blocked apps list. Click/tap on the plus Add an allowed app button and choose Recently blocked apps. Select any of the apps to add them to the allowed list. You can also Browse all apps from this page as well to manually add a selected app.



6. Navigate to and select the app (ex: "notepad.exe") you want to allow through Controlled folder access, and click/tap on Open. (see screenshot below)



7. When finished adding apps, you can close Windows Defender Security Center if you like. (see screenshot below)

*note Sometimes you may need to restart the computer to apply.








OPTION TWO [/i] Remove Allowed App from Controlled Folder Access in Windows Defender Security Center
1. Open the Windows Defender Security Center, and click/tap on the Virus & threat protection icon. (see screenshot below)



2. Click/tap on the Manage ransomware protection link under the Ransomware protection section. (see screenshot below)



3. Click/tap on the Allow an app through Controlled folder access link. (see screenshot below)



4. Click/tap on Yes when prompted by UAC to approve.

5. Click/tap on an added app (ex: "notepad.exe") you want to remove, and click/tap on Remove. (see screenshot below)



6. When finished removing apps, you can close Windows Defender Security Center if you like.





OPTION THREE [/i] Add an Allowed App through Controlled Folder Access in PowerShell
1. Open an elevated PowerShell.

2. Enter the command below into the elevated PowerShell, and press Enter. (see screenshot below)
*Arrow Add-MpPreference -ControlledFolderAccessAllowedApplications "Full path of app's .exe or .com file"

*note Substitute Full path of app's .exe or .com file in the command above with the actual full path (ex: "C:\Windows\notepad.exe") of the app (Notepad) you want to allow through Controlled folder access.

For example: Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Windows\notepad.exe"
3. You can now close the elevated PowerShell if you like.









OPTION FOUR [/i] Remove Allowed App from Controlled Folder Access in PowerShell
1. Open an elevated PowerShell.

2. Enter the command below into the elevated PowerShell, and press Enter. (see screenshot below)
*Arrow Remove-MpPreference -ControlledFolderAccessAllowedApplications "Full path of app's .exe or .com file"

*note Substitute Full path of app's .exe or .com file in the command above with the actual full path (ex: "C:\Windows\notepad.exe") of the allowed app (Notepad) you want to remove from Controlled folder access.

For example: Remove-MpPreference -ControlledFolderAccessAllowedApplications "C:\Windows\notepad.exe"
3. You can now close the elevated PowerShell if you like.









OPTION FIVE [/i] Configure Allowed Apps Policy for Controlled Folder Access in Local Group Policy Editor

*Warning Apps you add using this option to allow through Controlled folder access cannot be removed using Option Two and Option Four.

*note The Local Group Policy Editor is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Six below for this policy.
1. Open the Local Group Policy Editor.

2. In the left pane of Local Group Policy Editor, navigate to the location below. (see screenshot below)
*Arrow Computer Configuration\Administrative Templates\Windows Components\Windows Defender Antivirus\Windows Defender Exploit Guard\Controlled Folder Access




3. In the right pane of Controlled Folder Access in Local Group Policy Editor, double click/tap on the Configure allowed applications policy to edit it. (see screenshot above)

4. Do step 5 (default) or step 6 (configure) below for what you would like to do.


5. To Not "Configure allowed applications" for Controlled Folder Access
A) Select (dot) Not Configured or Disabled, click/tap on OK, and go to step 7 below. (see left screenshot below)

*note Not Configured is the default setting.

6. To "Configure allowed applications" for Controlled Folder Access
A) Select (dot) Enabled, and click/tap on the Show button in Options. (see left screenshot below)

B) In the Value name column, type the full path (ex: "C:\Windows\notepad.exe") of the app's .exe or .com file you want to add and allow through Controlled folder access. (see right screenshot below)

*note You will need to double click/tap in the field to be able to enter the full path.

C) In the Value column to the right of the added app, type the number 0. (see right screenshot below)

*note You will need to double click/tap in the field to be able to enter the number.

D) If you want to remove an added app, double click/tap on the Value name and Value fields for the app you want to remove, and edit them out until blank. (see right screenshot below)

E) When finished adding and removing apps, click/tap on OK. (see right screenshot below)

F) Click/tap on OK, and go to step 7 below. (see left screenshot below)






7. When finished, close the Local Group Policy Editor.





OPTION SIX [/i] Configure Allowed Apps Policy for Controlled Folder Access in Registry Editor

*Warning Apps you add using this option to allow through Controlled folder access cannot be removed using Option Two and Option Four.

*note This option is for the same policy in Option Five.

1. Do step 2 (default), step 3 (add apps), or step 4 (remove apps) below for what you would like to do.


2. To Not "Configure allowed applications" for Controlled Folder Access
*note This is the default setting. It will remove all apps added using this policy.
A) Click/tap on the Download button below to download the file below.
Undo_Configure_allowed_applications_group_policy.reg

Download
B) Save the .reg file to your desktop.

C) Double click/tap on the downloaded .reg file to merge it.

D) When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

3. "Configure allowed applications" to Add App and Allow through Controlled Folder Access
A) Click/tap on the Download button below to download the file below.

*note This downloadable .reg file will add the registry keys for you to make it easier to set in this step.
Configure_allowed_applications_group_policy.reg

Download
B) Save the .reg file to your desktop.

C) Double click/tap on the downloaded .reg file to merge it.

D) When prompted, click/tap on Run, Yes (UAC), Yes, and OK to approve the merge.

E) Press the Win+R keys to open Run, type regedit into Run, and click/tap on OK to open Registry Editor.

F) Navigate to the key below in the left pane of Registry Editor. (see screenshot below)
*Arrow HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications




G) In the right pane of the AllowedApplications key, right click on an empty space, click/tap on New, and click/tap on String Value. (see screenshot above)

H) Type the full path (ex: "C:\Windows\notepad.exe") of the app you want to add as the name of this string value, and press Enter. (see screenshot below)



I) Double click/tap on this string value (ex: "C:\Windows\notepad.exe") to modify it. (see screenshot above)

J) Type the number 0, and click/tap on OK. (see screenshot below)



K) Repeat steps 3G to 3J if you want to add anymore apps to allow through Controlled folder access.

L) When finished adding apps, you can close Registry Editor if you like.

4. "Configure allowed applications" to Remove Added App Allowed through Controlled Folder Access
A) Press the Win+R keys to open Run, type regedit into Run, and click/tap on OK to open Registry Editor.

B) Navigate to the key below in the left pane of Registry Editor. (see screenshot below)
*Arrow HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications




C) In the right pane of the AllowedApplications key, right click on the string value (REG_SZ) of the app (ex: "C:\Windows\notepad.exe") you want to remove, and click/tap on Delete. (see screenshot above)

D) Click/tap on Yes to confirm. (see screenshot below)



E) When finished removing apps, you can close Registry Editor if you like.

That's it,
Shawn


Related Tutorials

• How to Add Allow App through Controlled Folder Access context menu in Windows 10
• How to Enable or Disable Windows Defender Exploit Guard Controlled Folder Access in Windows 10
• How to Add Turn On or Off Controlled Folder Access context menu Windows 10
• How to Add or Remove Protected Folders for Controlled Folder Access in Windows 10

:)

 

How to remove drive from list of allowed apps in "controlled folder access"

I recently enabled controlled folder access in the Windows Security app. I was running an executable from a USB (assigned drive letter 'I:') that required access to one of my protected folders, so I allowed it via

Windows Security>Virus & threat protection>Manage ransomware protection>Allow an app through controlled folder access>Add an allowed app

After removing the USB drive the program I allowed is no longer in the list of allowed apps under "allow an app through controlled folder access". However, now "Drive (I" is listed as an allowed app.

It appears that I cannot remove the drive from the list of allowed apps. How can I remove it?

 

Add an Allowed App through Controlled Folder Access in Windows Defender Security Center

Hello 91fw, *Smile

Here's the context menu for adding apps to the allowed list to help.

*Arrow Add Allow App through Controlled Folder Access context menu Windows 10 | Windows 10 Tutorials

That quote means that you can add an .exe file you consider to be safe to be allowed access to your protected folders. Basically, an app exception list.

 

Add Protected Folders to Controlled Folder Access in Windows 10  

@maranna No need for copy /paste. You'll get a list of last blocked apps, and click on one to allow it trough.

*Arrow Add or Remove Allowed Apps for Controlled Folder Access in Windows 10 | Windows 10 Tutorials

 

Windows Security - Controlled Folder Access - Recently Blocked App List

Hello,

I thank you for your response. I know how to add and remove apps to and from the controlled folder access. My question is how to remove an app from the "Recently Blocked Apps" list. In Windows 1809 they made it easier to add apps to the controlled folder
access without having to navigate to the exe. They added a Recently Blocked Apps list you can select from. The steps for Windows 1809 are:

1. Open the Windows Security and click/tap on the Virus & threat protection icon.

2. Click/tap on the Manage ransomware protection link under the Ransomware protection section.

3. Click/tap on the Allow an app through Controlled folder access link.

4. Click/tap on Yes when prompted by UAC to approve.

5. Click/tap on Add an Allowed App (+) sign

6. Click or tap Recently Blocked Apps from the drop down menu. (NEW)

7. Click or tap on the (+) button for the app you want to add from the list. (NEW)

It is this Recently Blocked Folders List I am trying to edit to remove apps I have not authorized and that have been deleted from my PC and are still in this list. I know you can select an allowed app from the controlled folder access list and you will
see a REMOVE button, which in 1809 will put the app back in the Recently Blocked Apps list if it was there originally. But that same process does not work on the Blocked Apps list.

My question still remains:

How do you delete an app from the "Recently Blocked Apps" list in Windows Security for Windows 1809?

 

How add many programs to Controlled Folder Access?

Some related info that may help a little:
Add or Remove Allowed Apps for Controlled Folder Access in Windows 10 | Tutorials

- so you can see what is allowed now

To note:

Add additional folders and apps to be protected | Microsoft Docs


Personally I use




This allows you to 'white list' everything on a PC in a 'known good' state, and then when an unknown exe or dll is detected, prompts you to approve them.

Coupled with that is the ability to upload suspicious or new files to something akin to Virustotal - the result of a scan with multiple AV engines.








This really is fairly unobtrusive and well supported, and runs alongside any conventional AV