Controlled Folder Access not protecting mapped drives

Question

I have Controlled Folder Access set up on a Windows domain in audit mode.

Changes to files on mapped drives (network shares) are not being reported.

The drives are listed in the group policy setting by both drive letter and by FQDN.

I enabled Controlled Folder Access on a test computer and I get no notification or event log entry indicating CFA blocked the attempt.

I have searched high and low, but everyone says mapped drives can be protected by CFA.

Has something changed? Any secret to making this work?

Answer 1

Hi,
First of all, it is suggested to confirm that the GPO was applied successfully. You can confirm that by running the following command (run the CMD as administrator)：
Gpresult /h c:\report.html

And based on my understanding, the events will be logged only when the apps are suspicious or malicious.
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/evaluate-controlled-folder-access?view=o365-worldwide

Best Regards,

Answer 2

Thanks FanFan

I used rsop.msc to confirm GP is being applied each time I make a change to the GPO.

I have been using Microsoft's CFAtool to trigger event 1124 (CFA in audit mode) in the Windows Defender log.

I get log entries when I use CFAtool to create a test file in controlled folders on C:

But, when I use that same CFAtool to create a test file on a mapped drive (mapped to a network share) I get nothing. I have verified the mapped drive is listed in the rsop.msc results. The format I'm using in the policy is "P:\" and I also entered the FQDN to the network share. If I use the FQDN with the CFAtool I do get a log entry, but not when I use the mapped drive letter.

Answer 3

Answer 4

Hi,

When i did more research about it, i find that we need to use the full path of the mapping drives.

Network shares and mapped drives can be protected, but Controlled Folder Access does not support the use of:

Environment Variables
Wildcards
The Windows drive (typically C:)
Seriously, don’t protect the entire Windows drive as Windows will be unable to function correctly and strange behavior will result.
https://labs.portcullis.co.uk/blog/windows-10s-controlled-folder-access-feature/

This response contains a third-party link. We provide this link for easy reference. Microsoft cannot guarantee the validity of any information and content in this link.

Best Regards,

Answer 5

Hello,

Did you ever get this to work? I'm having the exact same issue, no matter how I try to "protect" a mapped network drive, it is not protected.
I'm using the CFAtool.exe to test.

All my local folders are protected just fine.

I've tried with:
O:\
O:\Subfolder