Why would I get a "Protected folder access blocked" notification from Defender when I open an xls under the conditions listed below?
The app is EXCEL.EXE, the folder is D:\Documents\Receipts.
- I've accessed the same xls in that same folder many many times in the past and gotten no "blocked" notification so apparently it has not been necessary to add EXCEL.EXE to the Controlled Folder Access "allowed app" list in the past.
- D:\Documents has always been on the CFA protected folders list.
- Even though the message said access was blocked, the xls opened fine.
I have made no changes since this happened. I did not add Excel.exe to the allowed list, but I can now open the xls without any Defender notifications coming up.
Sure I can ignore the incident, but any ideas about what happened? This block notification should not have happened. On top of that, nothing got blocked.
Windows 10 Pro 19042.685
Was the issue resolved?
If any reply is useful for you, please accept it as answer.
If you have any issue or concern, please reply to us directly.
The exact same thing happened to me today as well. It was just odd. I had created an excel spreadsheet from scratch yesterday. When opening the file today I received the Windows Security Alert notification. The file opened, however, when the file tried to autosave it presented an error message. The file is stored on my OneDrive. I went back into Protection History and allowed on this device. I think perhaps there is a conflict between OneDrive and the various executable files?
Regarding macros or third-party links: Nope, I verified neither of these exists. I will say when I originally created the sheet, I did copy and paste a few items from a website. I pasted it as text only. I did use the following to ensure something was not hidden: https://support.microsoft.com/en-us/office/find-links-external-references-in-a-workbook-fcbf4576-3aab-4029-ba25-54313a532ff1 no links are embedded in file.
I did notice that several other executable files of mine were also blocked, Adobe.exe, ptedit54.exe (Brother P-Touch label printer I use). There were blocked again from a folder on my OneDrive.
Assuming there is an additional layering of security Microsoft has put in place? When I get a warning, I want to ensure the system is not compromised as it's never a fun experience.