title | description | search.appverid | ms.service | ms.author | author | ms.localizationpriority | manager | audience | ms.collection | ms.topic | ms.subservice | ms.date | |||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Microsoft Defender for Endpoint Controlled folder access (CFA) demonstrations |
Demonstrates how Controlled Folder Access protects valuable data from malicious apps and threats, such as ransomware. |
met150 |
defender-endpoint |
siosulli |
siosulli |
medium |
deniseb |
ITPro |
|
article |
asr |
02/16/2024 |
Applies to:
Controlled folder access helps you protect valuable data from malicious apps and threats, such as ransomware. Microsoft Defender Antivirus assesses all apps (any executable file, including .exe, .scr, .dll files and others) and then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then the app can't make changes to any files in any protected folder.
- Windows 10 1709 build 16273
- Microsoft Defender Antivirus (active mode)
Set-MpPreference -EnableControlledFolderAccess (State)
Set-MpPreference -ControlledFolderAccessProtectedFolders C:\demo\
State | Mode | Numeric value |
---|---|---|
Disabled | = Off | 0 |
Enabled | = Block mode | 1 |
Audit | = Audit mode | 2 |
Get-MpPreference
Download and run this setup script. Before running the script set execution policy to Unrestricted using this PowerShell command:
Set-ExecutionPolicy Unrestricted
You can perform these manual steps instead:
-
Create a folder under c: named demo, "c:\demo".
-
Save this clean file into c:\demo (we need something to encrypt).
-
Execute PowerShell commands listed earlier in this article.
- Turn on CFA using PowerShell command:
Set-MpPreference -EnableControlledFolderAccess Enabled
- Add the demo folder to protected folders list using PowerShell command:
Set-MpPreference -ControlledFolderAccessProtectedFolders C:\demo\
- Download the ransomware test file
- Execute the ransomware test file *this isn't ransomware, it simple tries to encrypt c:\demo
5 seconds after executing the ransomware test file you should see a notification CFA blocked the encryption attempt.
- Turn off CFA using this PowerShell command:
Set-MpPreference -EnableControlledFolderAccess Disabled
- Execute the ransomware test file
- The files in c:\demo are encrypted and you should get a warning message
- Execute the ransomware test file again to decrypt the files
Download and run this cleanup script. You can perform these manual steps instead:
Set-MpPreference -EnableControlledFolderAccess Disabled
Clean up c:\demo encryption by using the encrypt/decrypt file