Regedit Key for Controlled Folder Access Exclusions

This article details the specific Windows Registry keys used to manage application exclusions and protected folder lists for Windows Defender Controlled Folder Access. By configuring these registry locations, administrators can permit specific applications to bypass ransomware protection blocks or define custom directories to safeguard.

The Allowed Applications Exclusion Key

The primary registry key responsible for managing the list of allowed application exclusions in Controlled Folder Access is:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\AllowedApplications

Inside this key, individual application exclusions are stored as registry values: * Value Name: The full file path of the executable allowed to modify protected directories (e.g., C:\Program Files\ExampleApp\app.exe). * Value Type: REG_DWORD * Value Data: 0

The Protected Folders Configuration Key

If you need to configure the list of custom directories that Controlled Folder Access protects, use the corresponding ProtectedFolders key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access\ProtectedFolders

• Value Name: The full directory path to be protected (e.g., D:\SensitiveData).
• Value Type: REG_DWORD
• Value Data: 0

Main Feature Control Key

To enable, disable, or set Controlled Folder Access to Audit Mode directly in the registry, configure the EnableControlledFolderAccess value under:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

• Value Name: EnableControlledFolderAccess
• Value Type: REG_DWORD
• Value Data Options:
  • 0: Disabled
  • 1: Block mode (Enabled)
  • 2: Audit mode (Logs events without blocking)
  • 3: Block disk modification only
  • 4: Audit disk modification only

Important Considerations

• Administrative Privileges: Modifying these keys requires elevated administrator privileges.
• Tamper Protection: If Tamper Protection is enabled in Windows Security, manual edits to non-policy Defender keys will be blocked. Applying exclusions via the SOFTWARE\Policies\ path through Group Policy or elevated scripts is the standard method for enterprise environments.