Windows Defender Controlled Folder Access: How to Configure Ransomware Protection Without Breaking Your Applications

Never enable CFA in enforcement mode without a prior audit phase. Enforcement mode blocks writes from unlisted applications immediately, which will break any application that writes to the Documents or Desktop folder without using the standard Windows file APIs in a way Defender recognizes. Enable audit mode via PowerShell: Set-MpPreference -EnableControlledFolderAccess AuditMode. Via Group Policy: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access > Configure Controlled Folder Access = Audit Mode. Via Intune: Endpoint Security > Attack Surface Reduction policy > Controlled Folder Access = Audit. After enabling audit mode, run it for 2 to 4 weeks. During this period, check the Windows Event Log under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational, filtering for Event ID 1124 (audit block) -- these are all the applications that WOULD be blocked if enforcement were active. Build your allow-list from these events.

Event ID 1124 shows the process that attempted the blocked write. Collect all unique processes over your audit period: Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Windows Defender/Operational'; Id=1124} | Select-Object @{Name='Process';Expression={$.Properties[5].Value}}, @{Name='Folder';Expression={$.Properties[4].Value}} | Sort-Object Process -Unique. For each process in the output: verify it is a legitimate business application (not a script or an unexpected binary). Add it to the CFA allow-list: Add-MpPreference -ControlledFolderAccessAllowedApplications 'C:\path\to\application.exe'. Via GPO: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access > Configure allowed applications. Via Intune: in the Attack Surface Reduction policy, add the process paths to the 'Additional controlled folder access allowed applications' list. Common applications that need allow-listing: line-of-business applications that save to Documents, PDF creators, screen capture tools, sync clients (OneDrive is auto-allowed by Microsoft, but some third-party sync tools are not), and backup agents that write to local user directories.

The default six protected folders cover personal user data. For business environments, add additional protected folders where sensitive data lives: network mapped drives (CFA can protect mapped drive letters on the local endpoint), application data directories that contain business-critical files, custom document repositories outside the standard user profile. Via PowerShell: Add-MpPreference -ControlledFolderAccessProtectedFolders 'D:\BusinessData'. Via GPO: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access > Configure protected folders. Add the additional folder paths. Note: CFA protects folder contents at the local file system level. For network shares and file servers, a different control is appropriate -- ransomware encrypting a file server via SMB must be detected via share access monitoring and honeypot files, not CFA on the endpoint (CFA on the endpoint does not protect network shares the endpoint accesses). CFA on the file server itself protects the file server's local storage, but most ransomware that targets file servers does so via SMB from a compromised client, not local execution.

After completing the audit phase and building the allow-list, switch to enforcement: Set-MpPreference -EnableControlledFolderAccess Enabled. In enforcement mode, Event ID 1123 logs each blocked attempt with the process name and targeted folder. Event ID 1124 no longer fires (that was audit-mode only). Monitor for new Event ID 1123 events in the first week after enabling enforcement -- these represent applications not in the audit-period data (less common applications, newly installed software). Add legitimate applications to the allow-list as they appear. When a user reports they cannot save a file: check Event ID 1123 on their device, identify the process, verify it is legitimate, and add it to the allow-list via Intune or GPO within 30 minutes. The allow-list update propagates via policy and does not require a reboot. For executive escalations where you need to immediately unblock a user: temporarily set CFA back to Audit mode on that specific device while you update the policy, then re-enable enforcement after the allow-list update propagates.

After enforcement, verify CFA blocks write attempts from unlisted processes. Safe test: create a simple PowerShell script that attempts to write a file to the Documents folder (not a Defender-trusted process). Confirm the write is blocked and Event ID 1123 appears. Do not test with actual ransomware simulators on production systems unless they are isolated VMs. KnowBe4 RanSim and similar ransomware simulators can be used in a test VM to verify CFA blocks the simulated encryption pattern. The Microsoft documentation includes a simple test: create a text file, rename it to test.exe, and attempt to write to the Documents folder from it -- CFA should block it. Verify via Defender for Endpoint (if deployed) that CFA events appear in the device's timeline in the Microsoft 365 Defender portal. This confirms both that CFA is enforcing and that the telemetry is reaching your security platform.