You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: defender-endpoint/controlled-folders.md
+49-18Lines changed: 49 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@ title: Protect important folders from ransomware from encrypting your files with
3
3
description: Files in default folders can be protected from changes through malicious apps. Prevent ransomware from encrypting your files.
4
4
ms.service: defender-endpoint
5
5
ms.localizationpriority: medium
6
-
ms.date: 04/15/2025
6
+
ms.date: 06/05/2025
7
7
author: denisebmsft
8
8
ms.author: deniseb
9
9
audience: ITPro
@@ -35,9 +35,19 @@ search.appverid: met150
35
35
36
36
> Want to experience Defender for Endpoint? [Sign up for a free trial.](https://go.microsoft.com/fwlink/p/?linkid=2225630)
37
37
38
+
Platforms
39
+
40
+
- Windows
41
+
38
42
## What is controlled folder access?
39
43
40
-
Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Controlled folder access can be configured by using the Windows Security App, Microsoft Endpoint Configuration Manager, or Intune (for managed devices). Controlled folder access is supported on:
44
+
Controlled folder access helps protect your valuable data from malicious apps and threats, such as ransomware. Controlled folder access protects your data by checking apps against a list of known, trusted apps. Controlled folder access can be configured by using Microsoft Defender for Endpoint Security Settings Management, Microsoft Intune, Microsoft Endpoint Configuration Manager, or the Windows Security App.
45
+
46
+
Controlled folder access works best with [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](investigate-alerts.md).
47
+
48
+
## Requirements for controlled folder access
49
+
50
+
Controlled folder access is supported on:
41
51
42
52
- Windows 11
43
53
- Windows 10
@@ -47,10 +57,11 @@ Controlled folder access helps protect your valuable data from malicious apps an
47
57
- Windows Server 2016
48
58
- Windows Server 2012 R2
49
59
50
-
> [!NOTE]
51
-
> Scripting engines like PowerShell aren't trusted by controlled folder access, even if you create an "allow" indicator by using [certificate and file indicators](indicator-certificates.md). The only way to allow script engines to modify protected folders is by adding them as an allowed app. See [Allow specific apps to make changes to controlled folders](/defender-endpoint/customize-controlled-folders).
60
+
Controlled folder access requires:
52
61
53
-
Controlled folder access works best with [Microsoft Defender for Endpoint](microsoft-defender-endpoint.md), which gives you detailed reporting into controlled folder access events and blocks as part of the usual [alert investigation scenarios](investigate-alerts.md).
62
+
-[Microsoft Defender Antivirus to be the primary antivirus (active mode)](configure-real-time-protection-microsoft-defender-antivirus.md).
63
+
64
+
- Real-Time Protection (RTP) needs to be on.
54
65
55
66
> [!TIP]
56
67
> Controlled folder access blocks don't generate alerts in the [Alerts queue](alerts-queue.md). However, you can view information about controlled folder access blocks in the [device timeline view](investigate-machines.md), while using [advanced hunting](/defender-xdr/advanced-hunting-overview), or with [custom detection rules](/defender-xdr/custom-detection-rules).
@@ -98,14 +109,14 @@ The same profile folders are also protected for system accounts, such as `LocalS
98
109
> [!NOTE]
99
110
> You can configure more folders as protected, but you can't remove Windows system folders that are protected by default.
> Scripting engines like PowerShell aren't trusted by controlled folder access, even if you create an "allow" indicator by using [certificate and file indicators](indicator-certificates.md). The only way to allow script engines to modify protected folders is by adding them as an allowed app. See [Allow specific apps to make changes to controlled folders](/defender-endpoint/customize-controlled-folders).
106
114
107
115
## Review controlled folder access events in the Microsoft Defender portal
108
116
117
+
> [!TIP]
118
+
> Controlled folder access blocks don't generate alerts in the **[Alerts queue](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Fcontrolled-folders.md/main/1f8f3424-7307-8178-dc20-b5160d121a7d/alerts-queue.md)**. However, you can view information about controlled folder access blocks in the **[device timeline view](/editor/MicrosoftDocs/defender-docs-pr/defender-endpoint%2Fcontrolled-folders.md/main/1f8f3424-7307-8178-dc20-b5160d121a7d/investigate-machines.md)**, while using **[advanced hunting](/defender-xdr/advanced-hunting-overview)**, or with **[custom detection rules](/defender-xdr/custom-detection-rules)**.
119
+
109
120
Defender for Endpoint provides detailed reporting into events and blocks as part of its [alert investigation scenarios](investigate-alerts.md) in the Microsoft Defender portal. For more information, see [Microsoft Defender for Endpoint in Microsoft Defender XDR](/defender-xdr/microsoft-365-security-center-mde).
110
121
111
122
You can query Microsoft Defender for Endpoint data by using [Advanced hunting](/defender-xdr/advanced-hunting-overview). If you're using [audit mode](overview-attack-surface-reduction.md), you can use [advanced hunting](/defender-xdr/advanced-hunting-overview) to see how controlled folder access settings would affect your environment if they were enabled.
@@ -131,15 +142,35 @@ You can review the Windows event log to see events that are created when control
131
142
132
143
5. Select **OK**.
133
144
134
-
The following table shows events related to controlled folder access:
145
+
The following table shows events related to controlled folder access:
A user tries to install an application that triggers Controlled folder access, if the software or application has an unknown reputation, a toast notification presents the user with the following:
Copy file name to clipboardExpand all lines: defender-endpoint/indicator-file.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ ms.service: defender-endpoint
6
6
ms.author: deniseb
7
7
author: denisebmsft
8
8
ms.localizationpriority: medium
9
-
ms.date: 05/16/2025
9
+
ms.date: 06/05/2025
10
10
manager: deniseb
11
11
audience: ITPro
12
12
ms.collection:
@@ -69,7 +69,7 @@ Understand the following prerequisites before you create indicators for files:
69
69
-[File hash computation must be enabled](/defender-endpoint/mac-resources#configuring-from-the-command-line). Run the following command: `mdatp config enable-file-hash-computation --value enabled`
70
70
71
71
> [!NOTE]
72
-
> On Mac, file indicators support Mach-O files (akin to `.exe` and `.dll` in Windows) scripts, such as sh/bash and AppleScript File (`.scpt`) files only.
72
+
> On Mac, file indicators support Mach-O files, such as `sh/bash` and AppleScript File (`.scpt`) files only. (Mach-O files are similar to `.exe` and `.dll` in Windows.)
![m365-skilling-repo-management[bot]](https://avatars.githubusercontent.com/in/1161012?v=4&size=40){kind=avatar}
0 commit comments