Customize protected folders and appsĭuring your evaluation, you may wish to add to the list of protected folders, or allow certain apps to modify files.

You can configure a Windows Event Forwarding subscription to collect the logs centrally. The following controlled folder access events appear in Windows Event Viewer under Microsoft/Windows/Windows Defender/Operational folder. Review controlled folder access events in Windows Event Viewer You can also use Group Policy, Intune, mobile device management (MDM), or Microsoft Configuration Manager to configure and deploy the setting, as described in the main controlled folder access topic. If you want to fully audit how controlled folder access will work in your organization, you'll need to use a management tool to deploy this setting to devices in your network(s). Set-MpPreference -EnableControlledFolderAccess AuditMode To enable audit mode, use the following PowerShell cmdlet: You can also get an idea of how many suspicious file modification attempts generally occur over a certain period of time. Test how the feature will work in your organization to ensure it doesn't affect your line-of-business apps. Use audit mode to measure impactĮnable the controlled folder access in audit mode to see a record of what would have happened if it was fully enabled. It explains how to enable audit mode so you can test the feature directly in your organization. This article helps you evaluate controlled folder access. It is especially useful in helping protect against ransomware that attempts to encrypt your files and hold them hostage. Controlled folder access is supported on Windows Server 2019, Windows Server 2022, Windows 10, and Windows 11 clients. Want to experience Microsoft Defender for Endpoint? Sign up for a free trial.Ĭontrolled folder access is a feature that helps protect your documents and files from modification by suspicious or malicious apps.

Controlled folder access windows 10