Windows 10: Change Windows Defender Controlled Folder Access Settings - Windows 10

Thanks Cliff. Good to know.

 

After having played with it briefly last week, I turned it off again, and have just clean installed both my laptop and my desktop.

Were these tests all performed in the same build of WinX?

 

Yep.

 

Firefox trying to make changes to %userprofile%\Desktop is driving me crazy!

Since a browser is the first to face the threats, how safe is to add it to the exception list?
I'm worried about worms and other stuff that could hijack the .exe

 

Same thoughts here... I'm not adding it to exceptions for now. On the other side, if browser is compromised and you're running it as admin, the damage is already done...

 

Sadly this is yet another software from Microsoft that is poorly designed. If one with at least half a brain looked into this mess and redesigned "Protected Folders" it could be a useful software. Now, it's just an nuisance.

 

I disagree - it is perfectly designed, and I'll warrant that a lot of other software could learn from this example.

When you enable it, it is enabled across the board for all software, even stock Windows software. If you want to make an exception, you have to make it manually.

It's way better than starting the software with a default set of exceptions, many of which most people will not use, and thus also provide a possible loophole for malicious software to exploit. You want XYZ program to access restricted folders, you have to explicitly allow it - Micro$oft is not going to make any assumption on what you might want to allow and might want to block.

It's completely simple and effective in that way.

 

The other thing that some do not realise is that when you whitelist an executable you are whitelisting that application running from that specific location, so if you somehow end up with a rogue application with the same name as the one you have whitelisted, it will throw up an exception message and prevent the application from accessing the data. This assumes that your applications are located correctly in the Program Files or Program Files (x86), and owned by trustedinstaller, and thus cannot be replaced by any lesser process

 

Researcher Bypasses Windows Controlled Folder Access Anti-Ransomware Protection

 

I do not use windows protected folders as I use the Bitdefender which is a lot easier to use - it fully fingerprints the application or App in use noting file size, location, and other forensic items to ensure that a re coded clone of a whitelisted executable cannot access the data as the whitelisted executable - it also prompts you if an executable tries to access data files and is not whitelisted and allows you to make a decision to whitelist the executable or not, (which allows you to check and decide), it retains a message about suspect items so it's easy to control what's controlled. I found the initial windows version very clunky in use so kept using Bitdefender

 

My CFA is blocking System32 files from making changes to memory, anyone know what that is about?

 

There is a reason this is disabled by default. I just turned it on and my goodness it blocks every *** thing lol. Turned off permanently.

 

*Roflmao2*Roflmao2*Thumbs

 

Had to add chkdsk.exe to the allowed list, otherwise ALL my external drives would fail a disk check like this ...

Microsoft Windows [Version 10.0.16299.371]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Windows\system32>chkdsk /v /f e:
The type of the file system is NTFS.
Volume label is 9.

Stage 1: Examining basic file system structure ...
26624 file records processed.
File verification completed.
0 large file records processed.
0 bad file records processed.

Stage 2: Examining file name linkage ...
51 reparse records processed.
29070 index entries processed.
Index verification completed.
0 unindexed files scanned.
An unspecified error occurred (696e647863686b2e 1f67).
An unspecified error occurred (6e74667363686b2e 170d).

C:\Windows\system32>

For a time, I thought ALL my drives were failing, I even reinstalled the OS, and then I was thinking my mortherboard was bad.

THEN I realised it was the CFA setting !!!!

 

It's a really unfortunate side effect of the whole concept of folder protection, I went through similar issues when I first activated my Bitdefender Anti Ransomware.
Because of the way that ransomware works and the fact that the scum that use it will by choice use a duplicate of a valid system file to host their code, any protection has to consider and protect against these aspects.

Microsoft has not, to my knowledge, made the side effects and requirements, known which causes confusion for users who often end up following the worst possible route and switching the protection off