Windows 10: Is anyone using Windows Defender Controlled folder access?

I spoke too soon. Some Microsoft apps are now being blocked from making changes. It would be nice to know what's whitelisted by default.

 

I was not aware of Windows Defender's built in Ransomware protection! However the first problem I have encountered is that my games can't access the documents folder to grab the save file/game settings etc! It is a great idea but seems very restrictive. What are your thoughts?

:)

 

Windows Defender Controlled Folder Access is blocking VLC media player

I posted somewhere on this post a very detail, step by step on how to cure the issue within Win 10.

 

Windows Defender Controlled Folder Access is blocking VLC media player

Do you have Version 1709? Check at Settings > System > About.

After choosing Virus & Threat Protection categorys, did you then choose Virus & Threat Protection Settings? It should be there. It's the only extra control Defender has to do something like that, in the latest version. But default setting is Off so it might
have been toggled on by a bloatware antivirus. Which do you have?

 

You're going to need to take time to add all the .exe you want.
Including Windows own ones, like WordPad, Notepad, Paint and so on.


You can find those in C:\Windows and C:\Windows\System32
Then you need to add the ones in Programs and Programs x86.

Some programs will also need certain .dll's or files in the ..bin and .etc folder also access given, to write to your C: partition and any other disk or partition you decided to add.


It took me a whole Saturday to do it, because after I did the ones I knew & thought about, I ran some of the ones I wasn't to sure of.

Also, installers(the ones you trust) will need permission too, so don't just click through, and always save them when downloading), incase you need to run the installer again, after you have given permission.

 

@Cliff S

Yikes that sounds like a long long job. So each and every file say in Documents you allowed through has to be added individually correct? You cannot allow whole folders it seems.

 

Not the files are allowed only the programs that can write to your disk(s)
The idea is to keep unwanted changes from happening to your installation and user folders(or any other dive/partitions.).

 

Hi there

Filtering / controlling at individual file level seems IMO a bit of a cackhanded way of doing it -- I'd imagine that a better (or at least seemingly more sensible way) would be to provide protection at the directory level .

That said though if your program can actually read by HDD sector / cluster then (although complex to do - it's dooable for some reasonably clever coders -- all you need to know is NTFS file structure and HDD geometry) your rogue program could easily bypass any of this type of file restriction especially on the NTFS file system.

Surely it would make more sense also only allow to have specific users who have "execute authority" which presumably can be done in Windows with some sort of adding users to specific groups..
However at least Ms is on the right track.

Personally I'd also like to see some type of "Sandboxing" HDD writes so that users can examine logs before actually updating HDD -- by this type of Sandboxing I don't mean running Virtual machines but not commiting changes to HDD until some process allows it. If anything untoward is on the system then in this way changes aren't committed to HDD.

Not sure how difficult or what changes to the Windows kernel is required -- at least Ms is on the right lines here -- the more sophisticated Virus writers know that people often take clean image of their system -- but spectacularly fail to adequately back up or control their data and this is what they are trying to do now rather than break your OS.

It's about time NTFS was replaced by a much better more modern file system with decent journalling -- NTFS is "Out of the Ark" as far as computing systems are concerned -- good in its day but been around for donkeys years. Obviously legacy hardware will have to support it for a while but a decent new FS with some sensible software RAID possibilities should be a priority for Windows updates / improvements.

Cheers
jimbo

 

Ah I see, you allow the particular application/game access to the protected Documents folder for the files it needs. I had things back to front and was allowing the individual files rather than the application, that would be cackhanded.

 

I actually turned on Controlled Folder Access last night. I am slowly but surely getting every needed program added. I would like to add something:

If you add a program and it doesn't work still, you will need to reboot. I had this happen last night with my screenshot program. If it still doesn't work, you might need to add the dll, etc like Cliff posted.

 

The notification from Defender helps with this, it tells you the exact name of the exe, dll, bin, etc. that was blocked.

 

Wow, that is great to know. Thank you for pointing this out.

 

Also would like to add something for anyone using Macrium..... Be sure to add the folder(s) where your backups are located. That way nothing can mess with your backups except Macrium. (and the programs you allow of course )

 

Interesting, Chrome and Firefox both can save pictures/files to the Desktop and I did not add them to allowed programs.

 

Welp, I can't be bothered to use this. I tried to install an app earlier and it blocked it, so I had to add the exe then reboot. Then again just a few min ago I had to update a game on steam and it writes to a folder in my Documents with the updater which required another reboot to allow and work properly.

Needs more work where an Admin user can add a program and have it work without a reboot. I will wait until they make some changes.