Windows Controlled Folder Access: What It Protects and How to Use It

Controlled Folder Access (CFA) is a Windows security feature that restricts which apps can change files in selected folders. It is designed to make it harder for ransomware and other untrusted software to alter protected files. It is useful as an extra barrier, but it does not replace antivirus updates or a backup you can restore.

What Controlled Folder Access does

CFA checks an app against a trusted-app list when it tries to change a file in a protected folder. An app that is not trusted is blocked from changing files there, and Windows can show a notification. You can protect additional folders and allow a specific app when you have verified that it is safe.

That boundary is narrower than “all files on the PC”: it applies to folders CFA protects. It also depends on which apps are trusted. A program that is allowed can still change files in protected folders, so the allow-list deserves care. Microsoft describes the feature as protection against ransomware and other unauthorised changes, not a guarantee that an attack cannot affect your data. See Microsoft’s overview of Windows Defender Exploit Guard and its Windows 11 Security Book .

Check whether your PC can use it

CFA requires Microsoft Defender Antivirus to be the primary real-time antivirus engine. If another antivirus product is active, the Windows setting may be unavailable or CFA may not operate as expected. Do not disable your antivirus just to make the switch appear; check your security product’s documentation or ask your organisation’s IT administrator.

For a work or school computer, check with IT before changing protection settings. Centrally managed policies may control whether CFA is on and which apps are allowed. The Australian Cyber Security Centre’s July 2024 Windows workstation guidance also recommends testing security changes first to reduce disruption to normal work.

Turn it on

On a personal Windows 10 or Windows 11 PC:

1. Open Windows Security from Start.
2. Open Virus & threat protection, then find Manage ransomware protection.
3. Turn on Controlled folder access. Approve the Windows prompt if one appears.
4. Review Protected folders. Add a folder only when it holds files you want covered and is not already protected.

Names and page layout can differ slightly between Windows versions. If the switch is missing, greyed out, or turns itself back off, check whether another antivirus app or an organisation policy manages the setting instead of trying to work around it.

Check your everyday apps

After enabling CFA, check that the programs you regularly use can still save to the places you expect.

1. Make a disposable copy of a document or other harmless test file. Do not use your only copy of important data.
2. Open the copy in your usual editor and save a small change in a protected folder.
3. Repeat with any essential app that writes to those folders, such as a photo editor, note-taking app, or backup utility.
4. If Windows reports a block, note the app name and full file path shown in the notification.

This is a compatibility check: it tells you whether your usual workflow is interrupted. A successful save does not prove that CFA will stop every attack, and a block by itself does not prove that a program is malware.

If a familiar app is blocked

First confirm that the blocked program is the one you intended to run. Check its file path, update or reinstall it from the software maker’s official source if needed, and make sure the block was not caused by an unexpected helper program. If this is a managed PC, send the details to IT.

If you have verified the exact app and need it to save into protected folders, use Allow an app through Controlled folder access and select that app. Allow only the specific, verified program you need. The permission applies to protected folders generally; it is not limited to the file or folder where the block appeared. If you cannot verify the app, leave it blocked and save the work somewhere else while you investigate.

Keep a recovery copy

CFA restricts some app changes; it does not create a restorable copy of your files. Keep a separate backup and periodically check that you can restore from it. This matters because a permitted app, a mistake, hardware failure, or an attack outside the protected folders can still put files at risk.

Sources available before 21 August 2025

• Microsoft Security Blog: Windows Defender Exploit Guard and Controlled folder access (23 October 2017)
• Windows 11 Security Book (September 2023)
• Australian Cyber Security Centre: Hardening Microsoft Windows 10 and Windows 11 Workstations (July 2024)