Controlled Folder Access Allowed Apps Registry Key

This article explains which Windows Registry key manages the authorized applications list for Windows Defender Controlled Folder Access. Controlled Folder Access protects critical directories from unauthorized changes by ransomware and other malicious programs, and administrators can manage which applications are permitted through this defense using the Registry Editor (Regedit).

The Registry Path for Authorized Applications

The primary registry key used to define and manage allowed applications via policy is:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications

If this path does not exist, the keys Windows Defender Exploit Guard and Controlled Folder Access\AllowedApplications can be created under HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.

For non-policy local settings, the Windows security subsystem stores local definitions at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications

(Note: Modifying the local, non-policy key directly requires Tamper Protection to be disabled or elevated system-level permissions.)

How to Authorize an Application

To whitelist an executable file so it can access protected folders without triggering blocks:

  1. Navigate to the AllowedApplications policy key in Regedit.
  2. Right-click the AllowedApplications folder, select New, and choose String Value (REG_SZ) or DWORD (32-bit) Value.
  3. Set the Value name to the full file path of the executable you wish to allow (e.g., C:\Program Files\ExampleApp\app.exe).
  4. Set the Value data to 0.

To remove an application from the allowed list, simply delete the entry corresponding to the executable’s path. Changes take effect upon restarting the Windows Defender service or rebooting the system.