Controlled Folder Access in Windows 10 Defender (Free Antivirus Protection) 🐛🛡️🖥️
Channel: Hetman Software: Data Recovery for Windows
Date: 2018-03-27

👍 Watch about controlled folder access: why we need it, how it works, how it can be enabled and how to set up certain folders for protection.

Controlled folder access is a function of Windows Defender meant to protect user files from encryption by various ransomware. According to Microsoft, any executable file is examined by the Windows Defender antivirus element to see if the application is dangerous or safe. If such application is rated as malware, it cannot modify any files in the protected folders.

Contents:
0:00 - Intro;
1:12 - Why we need this function
1:34 - How to enable this function
2:55 - Group policies
4:00 - PowerShell
4:45 - Controlled folder access events

How to Protect Files from Ransomware with Windows 10 Defender: https://hetmanrecovery.com/recovery_news/how-to-protect-files-from-ransomware-with-windows-10-defender.htm

PowerShell
You can also enable and configure Controlled folder access using PowerShell; to run it, right-click on the Start menu and select Windows PowerShell (Administrator). Alternatively, enter “PowerShell” in the search field and run it while holding down Ctrl + Shift to start it as Administrator. To turn the function on, enter the following command: Set-MpPreference -EnableControlledFolderAccess Enabled, and there are three options for this function: enabled, disabled or AuditMode.
To add a folder into the protected list, enter the command Add-MpPreference -ControlledFolderAccessProtectedFolders “[the folder to be protected]"
Add-MpPreference -ControlledFolderAccessProtectedFolders "[ C:\Users\Dmitry\Downloads]"
To add an application into the white list, use this command: Add-MpPreference -ControlledFolderAccessAllowedApplications “[name of the app to be whitelisted, including the path]"
Add-MpPreference -ControlledFolderAccessAllowedApplications "[ C:\Program Files (x86)\Adobe\AuditionCC\Adobe\Adobe Audition CC 2017\ Adobe Audition CC.exe]"

https://aka.ms/mp7z2w – Exploit Guard Evaluation Package

You can visit the Microsoft website to read about meanings of all event IDs. Find the link in the description. 
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/event-views-exploit-guard#list-of-all-windows-defender-exploit-guard-events 
5007 - Event when settings are changed.
1124 - Audited Controlled folder access event.
1123 - Blocked Controlled folder access event.

That is all for now.  I’m sure this information will be useful for you. So hit the Like button and subscribe to Hetman Software channel. Thank you for watching. Good luck.

Other videos: #FreeAntivirus, #ControlledFolderAccess, #Windows10, #WindowsDefender, #AntivirusProtection.