Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallFor most personal Windows 10 and Windows 11 users, yes. Controlled folder access (CFA) adds a useful barrier by stopping apps that Windows does not trust from changing files in protected folders. The cost is that a legitimate program may occasionally be blocked from saving there, so you need to know how to identify that app and allow it safely. CFA is not a ransomware guarantee, so it should sit alongside backups you can actually restore from.
What Controlled folder access does
Controlled folder access is part of the ransomware protection area of Windows Security. It checks apps against a list of trusted apps and blocks any app that is not trusted from changing files inside protected folders. Microsoft states that common personal folders, including Documents, Pictures, Videos, Music, and Desktop, are protected by default, and you can add more folders. When an app is blocked, Windows notifies you. (Source: Microsoft Support, Virus and Threat Protection in the Windows Security App.)
As an Amazon Associate I earn from qualifying purchases.
The feature controls file changes. It does not promise that every ransomware attempt will be stopped, and it does not promise that every encrypted file can be recovered. Think of it as one layer in a defense that also includes backups and safe browsing habits.
Who should turn it on
Whether CFA is worth enabling depends mostly on what your protected folders hold and what software you run. The trade-off is simple: more protection for your documents and photos, in exchange for an occasional interruption when a legitimate program writes to a protected location.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Enable it if your important files live in the default protected folders and you can handle a notification by checking the app involved.
- Enable it with care if you use specialized software, such as some creative, scientific, or accounting tools, that frequently writes into Documents or other protected folders. Expect to allow a few programs and learn the process first.
- Consider leaving it off only if the interruptions would repeatedly disrupt your work and you have no time to verify blocked apps. In that case, a reliable backup routine matters even more.
Microsoft notes that most apps should not need to be added manually, because Defender automatically trusts some apps based on prevalence and reputation. Blocks therefore tend to involve less common programs rather than mainstream software.
How to turn it on
On an individual PC, Microsoft’s current steps for the Windows Security app (per Microsoft Learn, Configure controlled folder access) are:
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Open Windows Security and select Virus & threat protection.
- Under Virus & threat protection settings, select Manage settings.
- Find Controlled folder access and select Manage controlled folder access.
- On the Ransomware protection pane, switch Controlled folder access to On and approve the User Account Control prompt.
Expected result: the switch stays on after you leave the page. If the switch will not change, confirm you approved the UAC prompt and that the PC is not under a policy that controls the setting.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →When an app is blocked
A blocked app usually shows up as a notification after you try to save, export, or update a file. Resist the urge to disable the feature or allow everything. Work through the following in order.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Step 1: Identify the executable
Note the name of the app from the notification and find its actual .exe file. Check that it is the program you expect, from the publisher you expect, and that you installed it yourself. An unexpected program writing to your documents is a reason to investigate, not to allow.
Step 2: Allow only a verified app
If the app is known and trustworthy, add it through Allow an app through Controlled folder access in the same Ransomware protection area. Browse to the specific executable. An allow entry applies to the app at the location you specify, so choose the real program path rather than a broad folder that could hold other files.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T120. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T120 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-C port : Insert the T120 security key into the USB-C port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Step 3: Avoid the common mistakes
- Do not allow unfamiliar apps just to clear a notification. Microsoft cautions that an added app can access protected files, so a compromised allowed app creates risk.
- Do not add a whole folder of programs when a single executable will do.
- Re-check the allowed list if you uninstall software, since stale entries serve no purpose.
Settings beyond the On/Off switch
The Windows Security app offers only On and Off. Other operating modes are configured through other routes. The table below summarizes what the cited Microsoft documentation states and where it does not say more.
| Configuration route | What it covers | Relevance for home users |
|---|---|---|
| Windows Security app | On or Off | The standard route for individual devices |
| Policy or PowerShell | Audit mode and disk-modification-only mode | Mainly managed or diagnostic setups; specific steps not stated in the cited Microsoft guidance |
| Intune or Configuration Manager | Centralized management of the feature | Recommended by Microsoft for larger managed environments (Microsoft Learn, Protect folders from ransomware with controlled folder access); not relevant for most personal PCs |
Recovery and backups
CFA and recovery are separate concerns. Windows Security’s ransomware protection area also describes ransomware data recovery through OneDrive integration. That is a recovery feature, not a blocking control, and it should be set up and tested on its own terms.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
An external drive can serve as an optional second backup destination. Microsoft’s cited guidance does not recommend a specific drive, and no drive should be assumed to be immune to ransomware. The useful test is whether you can restore a file from the backup and whether the backup is disconnected or otherwise isolated from the computer while it is idle.
Enabling CFA reduces one way that untrusted software can alter your files. A recent, tested backup is what lets you recover if something gets past it.
Microsoft’s documentation for the feature is available at Microsoft Learn, Protect folders from ransomware with controlled folder access.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
