01
Open the Ransomware protection page
Open **Windows Security > Virus & threat protection**, scroll to **Ransomware protection**, and click **Manage ransomware protection**. This is where Controlled Folder Access lives.
Turn on **Controlled folder access** in **Windows Security**, add your Documents and project folders, then allow the few apps that legitimately write to them.
Requirements
- Windows 11 25H2 with Microsoft Defender active (no third-party AV)
- Admin rights
- A list of apps that write to your protected folders (editors, backup tools, game saves)
Instructions
02
Turn Controlled folder access on
Toggle **Controlled folder access** to **On** and accept the UAC prompt. By default it protects Documents, Pictures, Videos, Music, Desktop and Favorites for every user.
⚠ warningRunning apps that save to those folders may be blocked immediately. Expect to whitelist a few in step 5.
03
Add your real data folders
Click **Protected folders > Add a protected folder** and add any custom paths that hold valuable data, such as a projects directory or a game-saves root.
D:\\ProjectstipYou cannot remove the built-in default folders, only add new ones.
04
Check the block history
Open **Windows Security > Virus & threat protection > Protection history** and filter by **Controlled folder access**. Every blocked write shows the app path and the target folder.
05
Allow trusted apps through
Back on the Ransomware protection page click **Allow an app through Controlled folder access > Add an allowed app > Recently blocked apps**, then pick the apps you trust (editor, Git client, backup tool).
⚠ warningOnly allow signed, known apps. Any allowed app can write anywhere in your protected folders.
06
Verify with a write test
Open PowerShell as a normal user and try to create a file in a protected folder from an unlisted app. Defender should block it and log the attempt in Protection history.
Set-Content -Path "$env:USERPROFILE\Documents\cfa-test.txt" -Value "test"tipIf PowerShell itself is allowed, run the test from a portable text editor instead to see a real block.
Common issues
Game saves no longer persist after enabling CFA
Add the game's executable via **Allow an app through Controlled folder access**, or move the save folder out of a protected path if the game writes under a system identity.
The toggle is greyed out
Real-time protection must be enabled and no third-party antivirus active. Check **Virus & threat protection settings** and uninstall other AV products first.
Office apps blocked when saving
They are usually auto-trusted. If not, add winword.exe, excel.exe and powerpnt.exe from Program Files via the allow-app dialog.
Frequently asked
Does CFA replace a backup?
No. It blocks unknown writes, but you still need offline or cloud backups against hardware failure and account compromise.
Can I enable it via PowerShell?
Yes, with Set-MpPreference -EnableControlledFolderAccess Enabled from an elevated prompt.
Does it slow down disk writes?
Impact is minimal in day-to-day use; large build systems writing thousands of files per second can see overhead.
How to undo this
Open **Windows Security > Virus & threat protection > Manage ransomware protection** and toggle **Controlled folder access** off, or run Set-MpPreference -EnableControlledFolderAccess Disabled from an elevated PowerShell.
Interactive version: checklist, feedback, related guides →
Free · no account needed · tracks your progress