Ransomware is one of the most dangerous types of malware affecting computers today. It can encrypt your personal files, documents, photos, videos, and other important data, making them inaccessible until a ransom is paid. To help protect users from these threats, Microsoft includes a feature called Controlled Folder Access within Windows Security.
Controlled Folder Access is part of Microsoft Defender’s ransomware protection system. When enabled, it monitors applications attempting to make changes to protected folders. If an unknown or untrusted application tries to modify files in those folders, Windows blocks the action automatically. This helps prevent ransomware and other malicious software from encrypting, deleting, or altering your important data.
Windows 11 includes this feature for all users, but it is turned off by default on many systems. Enabling Controlled Folder Access can significantly improve your protection against ransomware attacks while allowing trusted applications to continue working normally.
This guide explains several ways to enable Controlled Folder Access in Windows 11 and configure it according to your needs.
What Is Controlled Folder Access?
Controlled Folder Access is a Windows Security feature that protects important folders from unauthorized changes.
When enabled, Windows monitors protected folders and allows only trusted applications to modify files inside them.
Common protected folders include:
- Documents
- Pictures
- Videos
- Music
- Desktop
- Favorites
You can also add custom folders for additional protection.
Benefits of Controlled Folder Access include:
- Protection against ransomware
- Prevention of unauthorized file modifications
- Enhanced security for personal documents
- Additional defense against malware
- Protection for important business files
Method 1: Enable Controlled Folder Access Through Windows Security
This is the easiest and most common method.
Follow these steps:
- Press Windows + S.
- Type Windows Security.
- Open the application.
- Click Virus & Threat Protection.
- Scroll down and select Manage Ransomware Protection.
- Locate Controlled Folder Access.
- Turn the toggle switch On.
- Click Yes if prompted by User Account Control.
Once enabled, Windows will begin monitoring protected folders immediately.
Most users can stop here because the feature starts working automatically with the default protected folders.
Method 2: Enable Controlled Folder Access Through Settings
You can also access the feature through Windows Settings.
Follow these steps:
- Press Windows + I.
- Select Privacy & Security.
- Click Windows Security.
- Choose Open Windows Security.
- Click Virus & Threat Protection.
- Select Manage Ransomware Protection.
- Turn on Controlled Folder Access.
After activation, Windows will start protecting the default folders included in the ransomware protection system.
Method 3: Enable Controlled Folder Access Using PowerShell
Advanced users can enable the feature through PowerShell.
Follow these steps:
- Press Windows + X.
- Select Terminal (Admin).
- Enter the following command:
Set-MpPreference -EnableControlledFolderAccess Enabled- Press Enter.
The feature will be activated immediately.
PowerShell is useful for system administrators managing multiple computers or automating security configurations.
Method 4: Verify That Controlled Folder Access Is Enabled
After enabling the feature, it is a good idea to confirm that it is active.
Follow these steps:
- Open Windows Security.
- Go to Virus & Threat Protection.
- Select Manage Ransomware Protection.
- Check the Controlled Folder Access status.
If the switch displays On, the feature is active and protecting your files.
You can also verify through PowerShell:
Get-MpPreferenceLook for the Controlled Folder Access setting in the results.
Verification ensures that ransomware protection is functioning correctly.
Method 5: Add Additional Protected Folders
The default protected folders may not include all of your important data.
Follow these steps:
- Open Windows Security.
- Navigate to Manage Ransomware Protection.
- Click Protected Folders.
- Select Add a Protected Folder.
- Browse to the folder you want to protect.
- Click Select Folder.
The folder will immediately become part of the protected list.
This is useful for external drives, work projects, financial records, and personal archives.
Method 6: Allow an App Through Controlled Folder Access
Sometimes a trusted application may be blocked from accessing protected folders.
Follow these steps:
- Open Windows Security.
- Go to Manage Ransomware Protection.
- Click Allow an App Through Controlled Folder Access.
- Select Add an Allowed App.
- Choose Recently Blocked Apps or Browse All Apps.
- Select the trusted application.
Once approved, the application can modify files within protected folders.
Only allow software that you fully trust.
Method 7: Review Blocked Applications
Windows Security records applications blocked by Controlled Folder Access.
Follow these steps:
- Open Windows Security.
- Click Protection History.
- Review recent security events.
- Look for Controlled Folder Access notifications.
You can determine whether a blocked application should remain blocked or be added to the allowed list.
This helps maintain security while preventing disruptions to legitimate software.
Method 8: Disable and Re-Enable Controlled Folder Access
If you encounter configuration issues, temporarily disabling and re-enabling the feature may help.
Follow these steps:
- Open Windows Security.
- Navigate to Manage Ransomware Protection.
- Turn Controlled Folder Access off.
- Wait a few seconds.
- Turn it back on.
This refreshes the protection settings without affecting your protected folders.
Method 9: Enable Controlled Folder Access Through Group Policy
This method is available on Windows 11 Pro, Enterprise, and Education editions.
Follow these steps:
- Press Windows + R.
- Type:
gpedit.msc- Click OK.
- Navigate to:
Computer Configuration
→ Administrative Templates
→ Windows Components
→ Microsoft Defender Antivirus
→ Microsoft Defender Exploit Guard
→ Controlled Folder Access- Open Configure Controlled Folder Access.
- Select Enabled.
- Click Apply.
- Click OK.
- Restart your computer.
This method is commonly used in business environments.
Method 10: Keep Microsoft Defender Updated
Controlled Folder Access works best when Microsoft Defender is fully updated.
Follow these steps:
- Open Windows Security.
- Select Virus & Threat Protection.
- Click Protection Updates.
- Choose Check for Updates.
You can also install the latest Windows updates through Settings.
Updated security intelligence helps Defender identify trusted and malicious applications more accurately.
How Controlled Folder Access Works
When enabled, Windows continuously monitors protected folders.
If a trusted application such as Microsoft Word attempts to save a file, access is granted.
If an unknown or suspicious application attempts to modify protected files:
- Access is blocked.
- The action is logged.
- A notification is displayed.
- Your files remain protected.
This protection occurs automatically and does not require user intervention in most cases.
Default Folders Protected by Controlled Folder Access
Windows commonly protects:
- Documents
- Desktop
- Pictures
- Videos
- Music
- Favorites
Additional folders can be added manually as needed.
These folders often contain the files most frequently targeted by ransomware attacks.
Frequently Asked Questions
1. Is Controlled Folder Access available in Windows 11 Home?
Yes. Controlled Folder Access is available in Windows 11 Home and other editions that include Microsoft Defender Antivirus.
2. Can Controlled Folder Access block legitimate programs?
Yes. Occasionally, trusted applications may be blocked. You can manually add those applications to the allowed list.
3. Does Controlled Folder Access protect against ransomware?
Yes. It is specifically designed to help prevent ransomware from modifying or encrypting files in protected folders.
4. Should I leave Controlled Folder Access enabled?
Yes. For most users, keeping it enabled provides an additional layer of protection against ransomware and unauthorized file changes.
Final Thoughts
Controlled Folder Access is one of the most powerful security features included with Windows 11. By restricting which applications can modify files in protected folders, it helps defend against ransomware attacks and unauthorized file changes that could otherwise lead to data loss. Since ransomware continues to be a major cybersecurity threat, enabling this feature is a simple yet effective way to improve your computer’s security.
Windows 11 offers several ways to enable Controlled Folder Access, including Windows Security, Settings, PowerShell, and Group Policy. Most users can activate it in just a few clicks through the Windows Security app and immediately benefit from enhanced protection. Additional options such as protected folders and allowed applications provide flexibility while maintaining strong security.
If you store important documents, family photos, work projects, or financial records on your PC, enabling Controlled Folder Access is highly recommended. Combined with Microsoft Defender Antivirus, regular backups, and Windows updates, it can significantly reduce the risk of ransomware-related data loss and help keep your files safe.
