Controlled Folder Access: How to Turn On Windows Defender’s Ransomware Protection (and Fix Blocked Apps)

Controlled Folder Access is a Windows Defender feature that blocks untrusted apps from changing files in the folders you care about most, specifically to stop ransomware from encrypting them. It’s been part of Windows since 2017, but most people have never turned it on, and the ones who have often don’t realize it’s silently doing nothing because of one requirement almost every quick guide skips. Here’s how it actually works, how to turn it on properly, and how to fix it when it blocks something you genuinely trust.

How It Actually Decides What to Block

Controlled Folder Access doesn’t work from a list you maintain yourself. Defender evaluates every executable, script, and DLL that tries to touch a protected folder and automatically trusts most of them based on prevalence and reputation. An app Defender has never seen, or rarely sees, gets treated as untrusted and blocked until you manually allow it. The protection goes one level deeper than most people expect, too: it also blocks untrusted apps from writing directly to your drive’s boot sectors, aimed at bootkits and disk-wiper malware, not just the file-encrypting ransomware the feature is named for.

What’s Protected by Default

Out of the box, Controlled Folder Access protects your Documents, Pictures, Music, Videos, and Favorites folders, plus the equivalent Public folders, for every user and system account on the machine. You can add more folders, but you can’t remove these defaults — they’re always covered once the feature is on. If you’ve moved your Documents or Pictures folder via OneDrive’s Known Folder Move, protection follows it to the new location automatically, so you don’t need to re-add anything after setting that up.

One Requirement Most Guides Skip

Controlled Folder Access only functions when Microsoft Defender Antivirus is your primary antivirus and running in Active mode. If you run a third-party antivirus program as your main protection, Windows automatically drops Defender into Passive mode — and Controlled Folder Access stops doing anything at all, regardless of whether its toggle shows as on. This is the most common reason someone enables the feature, feels protected, and later discovers an untrusted app modified a protected file without being blocked: the toggle was on, but Defender wasn’t actually the one standing guard. If you’re not sure which antivirus is currently primary on your system, our guide on Windows Security showing Defender as off when it technically isn’t walks through how to check.

How to Turn It On in Windows 11

Open Windows Security, go to Virus & threat protection, and under Ransomware protection select Manage ransomware protection. Turn on the Controlled folder access toggle. That’s the entire setup for the basic protection — no restart required, and it takes effect immediately for new file-access attempts.

Adding Your Own Protected Folders

From the same Ransomware protection screen, select Protected folders, then Add a protected folder to cover anything beyond the defaults — a project folder, a secondary drive, or a network share. Subfolders inherit protection automatically, and network shares and mapped drives are supported, though you should point at the plain local or UNC path rather than a self-referencing loopback share. One limitation worth knowing before you protect a shared network folder broadly: Controlled Folder Access has to inspect every write attempt, and on a busy file server or NAS with many processes reading and writing at once, that inspection overhead can noticeably slow things down. It’s a reasonable tradeoff for a folder with genuinely sensitive files, not something to flip on for every shared drive in an office by default.

When It Blocks Something You Actually Trust

If a legitimate app gets blocked, go to Ransomware protection, select Allow an app through Controlled folder access, then Add an allowed app and point it to the specific executable. Two details trip people up here. First, allowed apps are matched by exact file location, not just filename — the same program installed in two different folders needs to be allowed separately in each one. Second, a newly allowed app doesn’t take effect for anything already running, including background services; you need to restart the app or service after adding it, not just the allow entry.

What Not to Do

Don’t add a network path in the self-referencing loopback format (something like pointing your own machine’s share back at itself) — use the plain local path instead, since loopback shares aren’t supported and will behave unpredictably. And resist the shortcut of broadly allowing powershell.exe or cmd.exe just to get one stubborn script working. Script engines can’t be trusted the way signed, reputable apps can, so allowing them wholesale effectively opens the exact kind of write access the feature exists to close off — any other script, not just the one you meant to permit, inherits that same trust.

Honest Limitations

Controlled Folder Access is not a backup and not protection against data theft — it only blocks untrusted apps from modifying or deleting files in locations you’ve specifically protected, and it does nothing for a folder you never added. Enterprise features like audit-only mode and more granular policies exist, but they’re configured through Group Policy, Intune, or PowerShell, not the consumer Windows Security app; on a personal PC, block-or-allow is genuinely all you get, and that’s enough for most home use. If you’re also weighing a separate paid antivirus on top of this, our breakdown of whether third-party antivirus is still worth it in 2026 covers where Defender’s built-in protection does and doesn’t go far enough.

FAQ