Windows 10: Controlled folder access problems

I turned on controlled folder access in latest Windows 10 and tested with a few programs I use. I tested by adding Libreoffice calc (c:\program files\libreoffice5\scalc.exe) as an allowed app. However, with controlled folder access on I can't save any spreadsheets that I modify in my Documents folder, which is one of the controlled folders. Same problem with saving an image from either Gimp or Photoshop Elements when I add them to the list of allowed apps.

In its present state this feature seems pretty unusable.

:)

 

Controlled Access Folder

Thanks John

I'll blame you when the pir8s come hacking.

But seriously the update is running well on the Surface Pro 4

 

Controlled Access Folder

Hi

In Windows Defender > Virus and Threat Protection Settings > there is an option:

Controlled Folder Access

Protected your files and folders from unauthorized changed(sic) by unfriendly applications.

This is followed by an On/Off switch.

After i updated to the 2017 Fall Update this switch was left as Off.

Many tech/and other websites are discussing that this should be changed to On.

Should I change it to On?

All other options were On except the Controlled Folder Access.

Regards

 

Hi NickJP.

As a test could you allow Notepad as an app and then try to save to documents. Would like to see if an MS program is allowed.

Any chance you moved your data files to a unique partition. If so how did you make move?


Ken

 

The problems seem to be twofold:

• For some programs, after adding a program as an allowed app, it still can't save until a reboot is performed. After rebooting, I could then save the same file OK from Photoshop Elements, though I had made no changes to the protected folders or allowed apps settings in Windows Defender.
• The base program is not necessarily the one performing the file save. The Libreoffice spreadsheet shortcut runs scalc.exe. By using Process Explorer to see what was happening at the point where the spreadsheet save failed, I could see that under the parent scalc.exe process were also soffice.exe and soffice.bin. When I added those two as well to allowed apps, I could then save spreadsheets OK. Same problem with saving from Gimp, though there I haven't yet got around to figuring out what additional files need to be added to allowed apps.

Particularly based on problem (2), this feature doesn't seem ready for prime time...can't see the average user using Process Explorer to figure out how to allow file saves when folder protection is enabled.

 

I'm getting a toast, action center message with path to the program it wont allow to save a file. Problem I see is when you click that toast it takes you to the folder you are saving the file to, rather than the program that is saving the file to, so you can quickly add it to the Allow list.

 

I see in my support to users who were asked by others or the PC press to activate the "controlled folder access feature" after the fall creators update that this feature has not been designed in a user friendly way. Programs which cause violations and stop working or give error messages because the funtion is activated do not in any way signal that the protection feature might be the cause. Just hanging without any fault message, cryptic error message that a file has not been found or- worse - that changed files read cannot be saved anymore after editing- without any indication.

I had to stop recommending this protection feature especially to simple users, wo are unable to remember that the feature had been activated and might be the cause of a problem- and switching off would fix it.

Microsoft has to find a way to let the protection software alert the user that an action of a program had caused it to act- regardless what the causing program indicates. The way it is implemented at the moment if activated is not recommendable - except to experianced windows users who know what they are doing.

 

The action center notification for a Controlled Folder Access event tells you exactly what was blocked and the path to find it. You can then just add it to the 'allowed apps' list.

This is not always the obvious executable you'd expect. @NickJP's LibreOffice is a case in point. To get full access for my LibreOffice it was soffice.bin that had to be an allowed app.

If you no longer have the action center notification to hand, or if the path was truncated because it's too long, don't worry. These Controlled Folder Access events are also recorded in the Event Log as Event ID 1123 in...
Application and Service Logs/Microsoft/Windows/Windows Defender/Operational

 

They do. There's a notification in the action centre that tells you exactly what was blocked and where it was trying to write to. Notifications are on by default - but of course, if a user has turned off all notifications they're not going to see this one either. That's their choice, not Microsoft's fault.

 

But the Action Center tells them what binary needs to be whitelisted.

 

Thanks a lot for pointing me to the message center, I must have overlooked them or they where cleared befor I connected to them. I will check it out over the next couple of weeks. Thanks also for ponting me to the event log for those cases. I found there a number of cases where setup.exe located in an app data temp directory was blocked to change something on the desktop.
Since I cannot add that as an allowable app, neither can I exclude the desktop from the protected directories, I would have to switch off the protection befor any kind of installation?

 

Yes, that would work. Turning off Controlled Folder Access does not clear the 'whitelist', so you could turn it back on again when you're done and still have all your permitted apps listed.