Regedit Key for Controlled Folder Access in Windows

Windows Defender Controlled Folder Access helps protect critical data from ransomware and unauthorized modifications by untrusted applications. This article provides the exact Windows Registry key, value name, and configuration data needed to manage, enable, disable, or audit Controlled Folder Access in Windows 10 and Windows 11.

Registry Key Location

The behavior of Controlled Folder Access is managed under the following path in the Windows Registry Editor (regedit):

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

If the Windows Defender Exploit Guard or Controlled Folder Access subkeys do not exist, they must be created manually under Windows Defender.

Registry Value and Data Settings

Within the Controlled Folder Access key, create or modify the following DWORD (32-bit) Value:

• Value Name: EnableControlledFolderAccess
• Value Type: REG_DWORD

Set the value data to one of the following integers to determine the feature’s behavior:

• 0 = Disabled: Turns off Controlled Folder Access entirely.
• 1 = Block Mode (Enabled): Blocks untrusted applications from making changes to files inside protected folders.
• 2 = Audit Mode: Allows changes but records events in the Windows Event Log (Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational) for testing purposes.
• 3 = Block Disk Modification Only: Restricts untrusted apps from writing directly to disk sectors.
• 4 = Audit Disk Modification Only: Logs attempts by untrusted apps to write directly to disk sectors without blocking them.

Additional Subkeys for Customization

To fully manage Controlled Folder Access via the Registry, two additional subkeys can be created under Controlled Folder Access:

1. ProtectedFolders
   • Path: ...\Controlled Folder Access\ProtectedFolders
   • Add custom folders to protect by creating a String Value (REG_SZ) where the Value Name is the full folder path (e.g., C:\CustomData) and the Value Data is set to 0.
2. AllowedApplications
   • Path: ...\Controlled Folder Access\AllowedApplications
   • Whitelist trusted applications by creating a String Value (REG_SZ) where the Value Name is the full executable path (e.g., C:\Program Files\App\app.exe) and the Value Data is set to 0.