Enable Controlled Folder Access in Windows 11

The Problem

Ransomware does not need administrator rights or a kernel driver to ruin your week. It only needs permission to write to the folders your files live in — and by default, every program you run has exactly that.

Controlled Folder Access flips the default. Windows keeps a list of protected folders (Documents, Pictures, Videos, Music, Desktop, Favourites) and a list of trusted applications. Anything not on the trusted list that tries to modify a file in those folders is blocked and you get a notification. An encryptor gets one file into the attempt and then stops.

It ships with Windows 11 at no cost, it is off by default, and almost nobody turns it on — usually because the first false positive is annoying enough that people switch it back off instead of adding the exception.

Already encrypted? This is prevention only, and it cannot decrypt anything. Go to what to do if hit by ransomware first.

Before You Start

Have a real backup regardless. Controlled Folder Access is a second line, not a replacement — see set up automatic backups and back up your PC with Windows Backup and File History. A ransomware attack that gets past this still loses you nothing if last night's backup is offline and intact.

Also expect friction in the first week: photo editors, game save managers, backup tools, and anything that writes to Documents will each need allowing once.

The Fix: Step-by-Step

Step 1: Turn It On

Windows + I → Privacy & security → Windows Security.
Virus & threat protection → scroll to Ransomware protection → Manage ransomware protection.
Switch Controlled folder access to On. Accept the UAC prompt.

That is the whole activation. Everything below is tuning so it does not get in your way.

Step 2: Add the Folders Windows Missed

The default protected set covers the standard user folders — but not a D:\Projects, a synced work folder outside OneDrive, or a photo library on a second drive.

On the same screen, click Protected folders → Add a protected folder.
Add every folder holding files you could not replace.

Do not add whole drives or C:\. Protecting C:\ blocks so much normal activity that you will end up disabling the feature entirely.

Step 3: Allow the Apps You Actually Use

When a legitimate program is blocked, Windows shows an "Unauthorised changes blocked" notification.

Manage ransomware protection → Allow an app through Controlled folder access.
Add an allowed app → Recently blocked apps — pick from the list Windows already recorded.
If it is not listed, choose Browse all apps and point at the .exe.

Common apps that need allowing: photo and video editors, Office when it saves to a non-default path, older game launchers writing saves to Documents, backup and sync tools, and archive utilities.

Step 4: Read the Block History Instead of Guessing

Blocks are logged even when you miss the toast:

Win + R → eventvwr.msc → Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.

Event ID 1123 is a blocked write; 1124 is an audited one. Each entry names the process path, which tells you whether to allow it or investigate it. If you see an event naming something you do not recognise, treat it as a real detection — see how to read Event Viewer.

Step 5: Test It Safely

Create a plain text file in Documents, then try to edit it with a portable tool you have never run before — a fresh download of a text editor, for example. It should be blocked. That confirms the feature is live rather than silently inactive.

Do not test with real ransomware samples. Ever.

Step 6: Pair It With OneDrive Version History

If your Documents folder is in OneDrive, you also get file version history and mass-deletion alerts. Together with Controlled Folder Access, that covers both "the encryptor was blocked" and "the encryptor got in through an app I had allowed."

Right-click a file in OneDrive on the web → Version history → confirm you can restore an earlier copy. That path is what actually saves you if the block ever fails.

Step 7: Keep the Rest of Windows Security On

Controlled Folder Access is one setting inside a stack. On the same Virus & threat protection page, confirm Real-time protection, Cloud-delivered protection, and Tamper Protection are all On. Tamper Protection specifically stops malware turning these off — if Defender is misbehaving, fix that first with Windows Defender not working.

What Not to Do

Do not allow an app just to clear a notification. If you do not recognise the process path, look it up. A blocked write from %Temp% or %AppData% with a random filename is the exact event this feature exists to catch.
Do not protect C:\ or Program Files. Windows Update, installers, and games will all break.
Do not treat it as antivirus. It stops file modification in specific folders. It does not stop credential theft, browser hijacks, or a cryptominer that never touches your documents.

Controlled Folder Access vs Backup vs Antivirus

| | Stops encryption | Recovers files | Catches other malware | |---|---|---|---| | Controlled Folder Access | Yes, for protected folders | No | No | | Offline backup | No | Yes | No | | Defender real-time | Sometimes | No | Yes |

You need all three. Any one alone has an obvious hole.

FAQ

Does Controlled Folder Access slow down my PC?

No measurable impact in normal use. It is a permission check on writes to a small set of folders, not a background scan. Heavy file operations inside protected folders — extracting a large archive to Documents — may be marginally slower on the first run while apps get evaluated.

Why is Microsoft Word being blocked when it is a Microsoft app?

Office is usually trusted automatically, but a portable install, a version launched from an unusual path, or a macro-enabled document saving to a protected folder can still trip it. Allow the specific WINWORD.EXE path shown in the block notification rather than disabling the feature.

Will it protect files on an external drive or NAS?

Only if you add those paths as protected folders, and only for drive letters mapped on that PC. It cannot protect a network share from a different machine that has write access. For a NAS, use its own snapshot or versioning feature.

Does this replace antivirus?

No. It is one specific defence against one specific behaviour — unauthorised writes to your documents. Keep Microsoft Defender or your chosen antivirus running with real-time protection on.

What happens if ransomware is already running when I turn it on?

Files it has already encrypted stay encrypted. Files it has not reached yet in protected folders are then blocked. Turning it on mid-attack is better than nothing, but the real answer is to disconnect the machine and follow the ransomware response steps.

Can I turn it on for a standard user account only?

The setting is machine-wide, not per-account. Running day to day as a standard user is a separate, complementary hardening step — see configure UAC and a standard user account.

Still Not Working?

If the toggle is greyed out, the setting is being managed by group policy or a third-party antivirus that has taken over Defender's role. Uninstalling the third-party suite returns control to Windows Security. On a work laptop, that policy is deliberate — ask your IT team rather than working around it.