Add Controlled Folder Access Folders with Regedit

Controlled Folder Access in Windows Defender prevents unauthorized applications and ransomware from modifying sensitive files in specified directories. While this feature can be managed via the Windows Security app or PowerShell, administrators can also configure it globally through the Windows Registry. This guide explains how to add custom protected directories to Controlled Folder Access using the Registry Editor (regedit).

Prerequisites

Before modifying the registry, ensure you have administrative privileges. You should also ensure Controlled Folder Access is enabled on the target machine.

Step-by-Step Guide

  1. Open the Registry Editor
    • Press Win + R on your keyboard to open the Run dialog box.
    • Type regedit and press Enter.
    • Click Yes if prompted by User Account Control (UAC).
  2. Navigate to the Exploit Guard Key

    • In the Registry Editor address bar, paste the following path and press Enter:

      HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

    • Note: If the Windows Defender Exploit Guard or Controlled Folder Access keys do not exist, create them by right-clicking the parent key, selecting New > Key, and naming them accordingly.

  3. Create the ProtectedFolders Subkey
    • Right-click the Controlled Folder Access key.
    • Select New > Key.
    • Name the new key ProtectedFolders.
  4. Add Your Protected Directory
    • Select the newly created ProtectedFolders key.
    • Right-click in the empty space on the right pane and choose New > String Value (or DWORD (32-bit) Value).
    • For the Value name, enter the exact, full file path of the folder you want to protect (e.g., C:\MyConfidentialData).
    • Double-click the newly created value and set its Value data to 0.
    • Click OK to save.
  5. Add Additional Folders (Optional)
    • To add more directories, repeat Step 4 by creating a new entry for each path with a value data of 0.
  6. Apply the Changes
    • Close the Registry Editor.
    • Restart your computer or restart the Windows Defender service to ensure the new protection paths take effect.