You can use the Windows Security app to view the list of folders that are protected by controlled folder access. To View or change the list of protected folders The best way is possibly collecting the related activities by Advanced Hunting features of Microsoft 365 Security or Defender for Endpoint.Ĭould we search for Event ID by running the advanced hunting query or not? You'll need to allow the Huntress agent through to get the Canary files.Ransomware acts with accessing to the files, folders and encrypting them, to respond against it, we need to enable the Windows Defender feature named “Controlled Folder Access” – WDCFA and monitor the Windows Defender Guard Events in Windows Event Viewer. Please note that Controlled Folder Access will flag the Huntress Agent creating Ransomware Canaries. You can add an app to the list of safe or allowed apps to prevent them from being blocked.Īudit mode allows you to test how the feature would work (and review events) without impacting the normal use of the device. This happens because Microsoft wants to keep you safe and will sometimes err on the side of caution however, this might interfere with how you normally use your PC. Occasionally, an app that is safe to use will be identified as harmful. Switch the Controlled folder access setting to On or Off.

Under Controlled folder access, select Manage Controlled folder access.

Under Virus & threat protection settings, select Manage settings.

Select Start > Settings > Update & Security > Windows Security > Virus & threat protection.

How does Controlled folder access work? Use controlled folder accessĬontrolled folder access in Windows Security reviews the apps that can make changes to files in protected folders and blocks unauthorized or unsafe apps from accessing or changing files in those folders.

Controlled folder access is also included as part of the modern, unified solution for Windows Server 2012R.

Controlled folder access is included with Windows 10, Windows 11, and Windows Server 2019. It's something that needs to be set locally on a machine (or via Group Policy).Ĭontrolled folder access - helps you protect valuable data from malicious apps and threats, such as ransomware. Huntress Managed AV cannot currently manage Controlled Folder Access.

Protected folder access blocked