Windows Defender Controlled Folder Access Registry Key

Windows Defender Controlled Folder Access (CFA) is a core anti-ransomware feature in Windows 10 and 11 that prevents unauthorized applications from modifying files in protected directories. This article identifies the exact master registry keys used to manage CFA settings, explains the corresponding DWORD values that control its operational states, and outlines the subkeys used to configure protected folders and allowed applications.

The Master Registry Path

The master policy settings for Controlled Folder Access are managed under the following registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

If you are inspecting the local, non-policy system state (or Windows Defender’s active configuration), the settings reside under:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access

The Master Control Value

Within the master key, the primary value responsible for turning the feature on or off is:

• Value Name: EnableControlledFolderAccess
• Type: REG_DWORD

The value data determines the operational state of the feature:

• 0 (Disabled): Controlled Folder Access is completely turned off. Unapproved applications can freely read and write to all folders.
• 1 (Enabled / Block Mode): Controlled Folder Access is fully active. Unrecognized or untrusted applications are blocked from modifying files in protected directories.
• 2 (Audit Mode): The feature monitors and logs all modification attempts to the Windows Event Log without actually blocking the applications. This is typically used by administrators to test for compatibility issues before enforcing full protection.

Managing Folders and Applications via Registry

Underneath the main Controlled Folder Access key, two optional subkeys exist to manage specific exceptions and directory paths:

1. Protected Folders:
   • Path: ...Controlled Folder Access\ProtectedFolders
   • Custom directories can be added as REG_SZ or REG_DWORD entries where the name is the full file system path to protect.
2. Allowed Applications:
   • Path: ...Controlled Folder Access\AllowedApplications
   • Executable paths can be added here as REG_SZ or REG_DWORD entries (with a value of 0 or 1) to allow specific trusted software through the blocklist.

How to Modify the Setting in Regedit

1. Press Win + R, type regedit, and press Enter to launch the Registry Editor as Administrator.
2. Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Windows Defender Exploit Guard\Controlled Folder Access.
3. If the subkeys do not exist, right-click the parent key and select New > Key to create them.
4. In the right pane, double-click EnableControlledFolderAccess (or create it via New > DWORD (32-bit) Value).
5. Set the Value data to 0, 1, or 2 depending on your requirements and click OK.
6. Restart the computer or restart the Windows Defender service to apply the changes.