Share via

Why is Controlled Folder Access (Ransomware Protection) blocking system services and programs after update to 1903.

Anonymous
2019-09-01T20:34:28+00:00

When I was on build 1809 with ransomware protection enabled, I only got alerts for 3rd party programs trying to write to the controlled folders.  Friday, Windows updated to 1903, and now I'm getting alerts that it is blocking Windows system files and services from protected folder and memory access.

So far it has blocked the following:

cleanmgr.exe

CompatTelRunner.exeexplorer.exe

msiexec.exe

SearchIndexer.exe

svchost.exe

WinSAT.exe

WmiPrvSE.exe

Why is it suddenly blocking Windows system processes and services?  Until the 1903 update, it never blocked any of these processes.  What was a minor annoyance for the extra protection has become a major pain and about to disabled it.  Whenever Defender blocks a program from protected folder or memory access, after allowing it I have to restart that program before it can write to the folders.  Now that it is blocking system services and processes, they remain blocked until I reboot.

Windows for home | Windows 10 | Security and privacy

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.

0 comments

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Anonymous
    2019-09-30T08:53:07+00:00

    So, with update 1903, Controlled Folder Acccess is turned on by default. This made almost all applications, including MS Office 2013, been unable to access the documents folder on my computer - without any useful message pointing to the real problem!! As a consequence, I spent a huge ammont of time trying different solutions. Until, finally, I remebered of this functionality.

    Do you, Microsoft people, know how many problems you cause to people with your arbitrary and bad planned decisions? And how much money is wasted solving the problems you cause?

    Buttom line, the difference between getting a computer not working because of a virus or because Microsoft made it not working becomes more and more the same thing.

    10+ people found this answer helpful.
    0 comments
  2. Anonymous
    2019-09-03T09:09:26+00:00

    Hi,

    Thank you for writing to Microsoft Community Forums.

    We understand your concern, as you are getting multiple instances of block of Windows system files and services by Controlled Folder Access after Windows 10 1903 update.

    Controlled folder access monitors apps for activities that may be malicious. By default, Windows adds apps that it considers friendly to the allowed list. Sometimes it might block a legitimate app from making legitimate changes to your files.

    We will certainly check this for you.

    However, we would like to know if the issue persists if you allow these services to the Allowed List.

    To allow and application through the Controlled Folder Access, please follow the section in Allow specific apps to make changes to controlled folders in the article Customize controlled folder access

    I would also suggest you to check for any pending updates in Windows Update and install, if any.

    Please get back to us with the results.

    Additional information on Controlled Folder Access Audit mode please refer this article: Evaluate controlled folder access

    We await your response.

    Aditya Roy

    Microsoft Community – Moderator

    0 comments