Windows 10: Change Windows Defender Controlled Folder Access Settings - Windows 10

Yes *Sad I was searching for that down arrow from you tutorials... just to find out it's only available to folders added manually.

Of course, it would be easier to manage that registry settings, if experienced user would provide a script for (i.e. remove desktop...) *Think

 

I just created a Custom View for Event Viewer to see exactly which .exe or .dll was blocked so one can find it easier, as notification area truncates the "offending" processes address.
For those that want to create it themselves; it's event 5007 in Defender logs

Controlled Access Events.zip

• Just download,
• right click,
• open properties,
• unblock,
• extract it,
• open Event Viewer,
• and import it.

***Click to enlarge***

This video is just a rough draft for now, to help others, until I have time to redo it correctly*Wink
[youtube]9S_7mkz7uZs[/youtube]

 

Great Cliff S *Thumbs

MS has some xml files ready to download on their site:
*Arrow docs.microsoft.com | event-views-exploit-guard#list-of-all-windows-defender-exploit-guard-events

Warning! XML file for exploit protection events (ep-events.xml) is wrong (just a copy of network protection events). Manually copy it from site above.

 

Bookmarked!
I love how a lot of the Microsoft tech sites let you choose between dark and light Glaring WHITE themes now.
I had set the Sysinternals page to dark months ago, and now where the option is, it will also be dark.

 

Is there any chance that a function like Allow/Block will be implemented soon or later?
I found it very difficult to allow apps to access Protected Folders. I can't find LibreOffice exe file, how can I add it?
Also I noticed that added allowed apps still prompt a denial access warning.
I'm so confused I disabled that feature for the time.

 

If you use the Event Viewer Custom View I posted above(post #32), you can find exactly what & where it is, that was blocked.
Here is another example:

 

@Cliff S
Thanks that will help a bit to understand what is going on.
As far as navigate the allow denies apps to access Protected folders. I can't get my head around it. But that is my short coming.

 

If you set up that custom view in Event viewer (that Cliff S posted), you can copy marked text - just like in the picture from Cliff. When allowing app to access Protected folders, click to "Add an allowed app" and paste that in file path and name. (Ctrl+C and Ctrl+v work fine))





Also navigating to shortcut and selecting it works for me

 

@Andre Ten
Much appreciated.
Just realized that this thread is a tutorials thread. I think I have to explain my post in reply to @Brink post #4.
I wanted to know if windows Defender exploit mitigation feature will eventually became more user friendly for people like me, quite hopeless navigating OS features.
I guess I posted in the wrong place and apologize.

 

@Pulcinella, I just added a rough draft for a video(made more on the fly than with real thought & planning) on how to do it, to my post above, but here it is now:
[youtube]9S_7mkz7uZs[/youtube]

 

You're welcome*Smile

 

If you like the concept of ransomware protection then take a look at the bitdefender options - it's a lot more configurable - both in adding and removing folders and allowed apps whitelist

I'm using the full security suite - paid version (unlimited PC MAC, Android & IOS devices With central management) but not sure what if any of the paid options are available in the free one

 

@Barman58
Thanks for your suggestion.
Now that Windows Defender offer a decent protection greatly increased by the anti exploit features, I would very much prefer keeping as much as possible native apps in my computer to avoid conflicts.
Unfortunately I had some difficulty with Bitdefender free since migrating to Windows 10.
I had no issues on W 7 and I liked it very much then, simple install and forget, just for me.
Now I have Mbae and use to have VoodooShield, I uninstalled VS as I'm looking to streamline my protections, in short to keep it simple.

 

A big sorry to everyone that downloaded my posted Eventlog "custom view".
I just noticed it was my LOGS and not the custom view I had uploaded.
I have now corrected the post: Change Windows Defender Controlled Folder Access Settings - Windows 10 - Page 4 - Security System Tutorials

But for those who have "installed" the wrong one already, here is the correct one: Controlled Access Events.zip

 

Now for the reason I noticed it:

I had to do a clean install this weekend(too long a story), and I'm in the middle of resetting my system back to somewhat the way it was.
I had forgotten to save a copy of this custom view, and came here to get it, when I installed it, I notices it wasn't the view, but the log*Redface oop!

Anyhow, something else I found out about using Controlled Access:
If you use multiple disks for everything, like I do, libraries on one disk, OneDrive on another, and system Images on yet another one, you will find you get permission problem accessing those disk and the folder on them.


So the moral of the story: if you want to or must do a clean install: turn off controlled access(make a copy of the registry key if you wish), then do the clean install.