Windows 10 Controlled Folder Access

Transcription

1 Windows 10 Controlled Folder Access Controlled Folder Access is a new feature introduced in the Windows 10 Fall Creators Update, release on 17th October Controlled Folder Access is an optional and powerful security feature that is Off by default. You can choose to turn on or off. Turning it on helps protect for personal files from rogue ransomware and other malware that seek to damage your files. This feature is part of Windows Defender so it is not available if you use a 3rd party antivirus. If you decide to turn the feature on, you may find that some of your Desktop apps, including apps recommended by EuroSCUG such as KeePass, Photofiltre, Picasa, GIMP, SyncToy, are blocked from saving files. If this occurs, you need to allow them access. Allowing access requires that you can locate the execution file for the app. If you are unsure about how to do that, seek assistance at our meeting or your Local Area Group. If you have turned Controlled Folder Access on and cannot work out how to allow apps, or you are having other issues with it, just turn Controlled Folder Access off and restart your computer. Then seek assistance if you still want to use it. How does it work? Controlled Folder Access monitors the changes that apps make to files in protected folders. If an unknown app attempts to make a change to these folders, it may display a strange message about a file problem and you will get a notification from Windows about the attempt. Documents, Pictures, Videos, Favourites, and Desktop folders are automatically protected. You can add other folders to protect, such as folders on a permanently attached USB disk. If Controlled Folder Access has blocked an app you trust, you can add it as an allowed app. This permanently allows the app to make changes to protected folders. Many apps trusted by Microsoft, such as Microsoft Office, are allowed without having to add them yourself. How to turn Controlled folder access On/Off Go Start > Settings > Update & Security > Windows Defender Click Open Windows Defender Security Centre Click Virus & threat protection Click Virus & threat protection settings Scroll down to Controlled folder access and turn it On or Off as required Another way to get to it is to right click on the Windows Defender Security Centre icon in the system tray (right hand side of the task bar) then click Virus & threat protection as above.

2 What happens if an app is not allowed folder access? An app may get an error indicating a file problem either when you are installing the app, or running it, and a message will appear from Controlled Folder Access, warning Unauthorised changes blocked. The message only appears on the screen for a short period, but you can see it in the list of notifications by clicking on the notifications icon bottom right of screen, or you can view the full details in the Windows Event viewer: Error occurs when installing an app The most likely cause is the application attempting to place a shortcut on the Desktop. The installation should otherwise be OK. This example occurred when installing an app called Personal Backup. The message on the left is a complaint from the Personal Backup installer when attempting to place a shortcut icon on the Desktop. The message bottom right is the resulting message from Controlled folder access. In fact, the installation worked OK apart from the missing shortcut. If you want the shortcut on the Desktop: Open the Start menu and scroll down the list of apps until you find the app Drag the icon to the Desktop

3 Error occurs when running an app The app cannot to save or modify a file. This could occur for a couple of reasons: You are running the app for the first time and it is attempting to set up a special folder in your Documents or Pictures folder You have asked the app to save a file you have created or modified in the app In this example the AceMoney app is prevented from saving a file In this case you need to: Close the app Identify and locate the app s execution file (this could be a.exe or.bin file) Add the app s execution file (.exe or.bin) as an allowed app using Controlled folder access settings Restart the app - it should then run correctly. Your app s execution file would normally be installed on your system drive (usually C: drive) in either the Program files or Program files (x86) folder. It could be elsewhere if, when you initially installed the app, you directed that it be installed on a different disk. Finding the name of the app is tricky. In many cases it is obvious, such as Keepass.exe for the KeyPass app, but in the case of Apache OpenOffice app, the execution file is called soffice.bin

4 How do you find the location and name of the apps execution file? You will get at least the execution filename from the notification message that Controlled folder access put on the screen. But that doesn t stay there for long - to see the notification again, click on the Notifications icon. In the AceMoney example, the notification says: Unauthorised changes blockedcontrolled folder access blocked C:\Program \AceMoney.exe from making changes.. You can establish the execution file name from this notification in this case it is AceMoney.exe. But the full folder path is truncated, leaving you to guess where it might be. You can try searching for it using File explorer, but the best way is to note the date and time of the event then get the full path from the Windows Event viewer (see next page). When you find the file, make a note of it and go to How to Add a trusted app as an allowed app (see later in this document)

5 Finding the Controlled folder access event in Windows Event Viewer Open the Event Viewer RIGHT click Start, LEFT click Event Viewer The left hand side of the Event Viewer window has a folder tree, navigate to: Applications and Services logs> Microsoft > Windows > Windows Defender Click on Operational to see the list of Windows Defender events Controlled folder access events are event code Filter the events so only code 1123 events are displayed. On the Actions pane right hand side click on Filter current log By now you may be thinking that this is a lot to do just to find an event! Appendix A of this document explains how you can create a Custom event view in Windows Event viewer, so in future you can get directly to the 1123 errors.

6 In the Filter window, enter 1123 as shown, then click OK The centre windows will now show all the Controlled folder access events. Locate the one using the Date/Time you wrote down earlier. Path: will tell you the folder that the app was trying to access Process name: will give you the full path and name of the execution file.

7 How to Add a trusted app as an allowed app: Click the Defender icon (bottom right of the screen, may be in Hidden icons), alternatively Start > Settings > Update & Security > Windows Defender > Open Windows Defender Security Centre Click Virus & threat protection, then Virus & threat protection settings

8 Scroll down to Controlled Folder Access and click Allow an app through Controlled Folder Access Click the + sign next to Add an allowed app Locate and select the execution file for the app then click Open. In this example we have added KeePass John Allen, November 2017

9 Appendix A Saving a Custom Event View in Windows Event viewer This explains how you can create a Custom View containing only Controlled Folder Access events, so that you can save time searching Event Viewer. Close Event Viewer if it is open Open Event Viewer RIGHT click Start, LEFT click Event viewer The left hand side of the Event Viewer window has a folder tree, navigate to: Applications and Services logs> Microsoft > Windows > Windows Defender Click on Operational Do not enter a filter code or click on any events at this stage In the right hand pane, click Create Custom View

10 In the Create Custom View window, provided that you have followed the above instructions you will see that the path to Defender event logs has been pre-entered. Just enter 1123 as shown then OK Now you need to give this custom view a Name and Description of your choice, then click OK In future, to see Controlled Folder Access events, start Event Viewer and click on your custom view in the Custom Views folder