Windows 10: WinSAT.exe blocked by Windows Security Ransomware Protection

Windows 10 Home 1909

Protected Memory Access Blocked for WinSAT.exe
Protected Folder: \Device\HarddiskVolume3

I have been having problems connecting external hard drives (that's on another thread on this forum) and I'm wondering if that has anything to do with it?

I've not unblocked it yet but I'm wondering what it does and should I allow this through and what this protected folder is, and by not letting it through what problems could occur?

:)

 

windows security wont help with ransomware protection

Hi,



Thank you for writing to Microsoft Community Forums.



We understand the difficulties you are facing while setting up the
Ransomware protection feature on your PC. In order to get clarity and to assist you accordingly, please reply with the answers to the questions below:

• What is the Windows Version and Build of Windows 10 installed? (Type
  winver in Windows search/Run command)
• What is the make and model of the PC?

• Do you have any non-Microsoft Antivirus/security program installed?
  
• Is OneDrive installed on the PC?
  

In this scenario, if OneDrive is missing, we can try the following steps and check.

1. Download and install
   OneDrive.
   
2. Once OneDrive is installed, then sign in with your Microsoft account.
   
3. Then Press Windows + I key and select Updates & Security.
   
4. Click on Windows Security from the left pane.
   
5. Click on Virus & threat protection.
   
6. Scroll down and check if you still have the Setup OneDrive button.
   
7. Click on Manage ransomware protection link and you will see your Microsoft Account under OneDrive.
   

You may also refer these articles for more information:

Microsoft Defender
Antivirus in the Windows Security app

Stopping ransomware
where it counts: Protecting your data with Controlled folder access



Regards,



Aditya Roy

Microsoft Community – Moderator

 

Malware and ransomware protection

You might also want to have a look at:

• https://www.microsoft.com/en-us/wdsi/help
• Top 10 Ways PUPs Sneak Onto Your Computer. And How To Avoid Them.
  
• Ransomware FAQ - Windows Defender Security Intelligence
• Ransomware Avoidance
  
• How to remove ransomware the right way: A step-by-step guide
  

 

Why is Controlled Folder Access (Ransomware Protection) blocking system services and programs after update to 1903.

When I was on build 1809 with ransomware protection enabled, I only got alerts for 3rd party programs trying to write to the controlled folders. Friday, Windows updated to 1903, and now I'm getting alerts that it is blocking Windows system files and services
from protected folder and memory access.

So far it has blocked the following:

cleanmgr.exe

CompatTelRunner.exeexplorer.exe

msiexec.exe

SearchIndexer.exe
svchost.exe

WinSAT.exe

WmiPrvSE.exe

Why is it suddenly blocking Windows system processes and services? Until the 1903 update, it never blocked any of these processes. What was a minor annoyance for the extra protection has become a major pain and about to disabled it. Whenever Defender
blocks a program from protected folder or memory access, after allowing it I have to restart that program before it can write to the folders. Now that it is blocking system services and processes, they remain blocked until I reboot.