CFA Audit mode

Question

Controlled Folder Access has been deployed via SCCM in Audit mode, reflected internally as value **4

Could you please confirm what should be the value for audit?**

Answer 1

Hello Nayak, Jitendra,

4 is Audit disk modification only.

Refer to: https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-defender#enablecontrolledfolderaccess
The equivalent SCCM policy setting would be - Audit disk sectors only. Refer to: https://learn.microsoft.com/en-us/intune/configmgr/protect/deploy-use/create-deploy-exploit-guard-policy#bkmk_CFA

Hope this helps!

If you found the information above helpful, please Click Yes. This will assist others in the community who encounter a similar issue, enabling them to quickly find the solution and benefit from the guidance provided.

Answer 2

For Controlled Folder Access, the numeric values for the EnableControlledFolderAccess rule state are:

• 0 = Disabled (Off)
• 1 = Enabled (Block mode)
• 2 = Audit mode

So the correct value for Audit mode is 2.

Note: In some management tools (such as Configuration Manager/Intune), additional internal or UI-specific values can appear, but per the documented CFA rule states, Audit mode corresponds to value 2.

---

References:

• Controlled folder access (CFA) demonstrations (block ransomware)
• Controlled folder access (CFA) demonstration test tool (block script)
• Enable controlled folder access
• Evaluate controlled folder access