Windows 10: Change Windows Defender Controlled Folder Access Settings - Windows 10

Excellent point! Hope some of us can use this and provide MS the feedback for improvement.

 

As I understand, based on my understanding of Bitdefender and also from some minor titbits of Information from Microsoft, the Anti-Ransomware software when you mark an executable as safe will note the details and create it's own form of HashKey to prevent any other cloned executable from running and triggering the Ransomware. How it works I do not, and do not want, to know. If I could learn the algorytm used then so could the Ransomware Writers and circumvent the protection.

 

I'm one of those. Cannot get my head around all what I'm suggested to do to make that feature working without hassle.
*Banghead

 

I have it turned on. It took about a week or so to identify and permit some half-dozen apps that I use (and it blocked from saving to my user folder). After that learning curve it hasn't got in my way.

Helpfully, the notification tells you exactly which app was blocked, so you know exactly what to add as an 'allowed app'.

If you no longer have the action center notification to hand, or if the path was truncated because it's too long, don't worry. These Controlled Folder Access events are also recorded in the Event Log as Event ID 1123 in...
Application and Service Logs/Microsoft/Windows/Windows Defender/Operational

 

Kind of bored here. Thanks for the information. I will see if it doesn't drive me absolutely bonkers trying to get all my apps added.

I turned it on the other day when not ready to do this and within couple minutes I turned it off so fast *ROFLMAO2

 

Yes, that was my first reaction too *Biggrin

But after a few weeks of adding apps the notifications stopped and it doesn't get in my way now.

 

If anyone that has this setting turned on and uses the program Lightshot to take screen shots, gets it working, please let me know. I have added the exe for Lightshot per the blocked logs in Event Viewer but it still will not let me save a screen shot to the desktop.

EDIT: I had to reboot after adding Lightshot to the allowed programs. I will now make sure every program I need is added and then perform one last reboot tonight.

Also added every one of my Macrium image location folders. I wasn't sure if adding just Y:\ (backups on Y drive) would cover the entire drive or not.

 

Intrigued, I've just downloaded and installed Lightshot on my test machine. Yes, adding it to allowed app doesn't work....


....until, that is, you restart the PC. It seems that because Lightshot.exe is already loaded in memory and running when you added it to 'allowed apps' the old controlled folder access settings still apply. A restart is necessary for the new settings to have an effect.

 

There was a post on the first page where some programs being added needed a reboot. I got the idea to reboot from there. I read this whole thread from this page back to first lol. Could have saved time if I had started at the first page. *Tongue

 

Programs are beginning to pop up that'll make use of controlled folders a bit easier..

sordum | defender-injector-v1-0 is free, as far as I'm seeing, it's portable and also adds context menu for adding and removing programs to/ from allowed apps..

It's clean according to Virustotal

 

Folder protection should not allow any exception of files, if it is to work then the exceptions should be by whitelisting apps only. which in addition should fully "fingerprint" the apps whitelisted

The problem with file exceptions is that the way that Humans behave will lead to the situation of them deciding that they do not want their most important data files "messed with" and will exclude them. The major issue with that is the very files that they want protected will be left open to attack by ransomware

 

Should have said allowed app. But, of course, agree with you.. too many allowed apps and this approach have no sense any more..