Blocked access

Question

I have been getting messages that state: "Protected folder access blocked." How do I find out what folder was involved and information regarding the source of the access? It has happened three times lately and I would like to put a stop to it.

Answer 1

Like most, you have this backwards.

the only reason you'd need to 'put a stop' to these Protected Folder Access Blocked notifications is if they're actually causing a true problem, such as stopping you from completing a task using an app that you must be able to perform.

The reason is that, by default, Controlled Folder Access (CFA) blocks any attempt by apps to directly write into a list of protected folders such as documents using mostly older, outdated methods that Microsoft had tried to get developers to stop using years or even decades ago. Unfortunately, these are some of the same techniques used by ransomeware to overwrite or do other damage, so by automatically blocking these write attempts, CFA typically stops most common ransomeware in its tracks.

Unfortunately, consumers are often oblivious to any of this, so when they see such notifications, they believe something needs to 'be done' which is almost never true.

In reality, one of the most common situations where these notifications occur is when Windows Update completes and either a driver or utility pack update finishes by trying to copy some file, often a sample picture, video or app file format, directly into a Protected folder like Documents, Pictures, or video.

Since in most cases, a typical user will never even try to find these sample files or care whether they're present, it really doesn't often matter that these file copies were blocked, so there's actually nothing needing to be 'fixed', it's just the user' misunderstanding of these notifications causing them to believe this.

Since bypassing these 'error' notifications means opening a potential hole through which actual ransomeware might possibly launch an attack, it's most often best to never try allowing these typically unnecessary files to be copied and written.

So my version of this is to simply learn to ignore these CFA notifications, unless shortly after a new one is displayed, you have a specific problem either using a new app or find that an important sample or other file is missing, which isn't at all likely, since those would usually have been placed in the app's program files folder where they belong.

Rob

Answer 2

To find out what folder was involved when you received the "Protected folder access blocked" messages, you can review the Windows Event Viewer. Here are the steps to do so:

1. Open Windows Event Viewer: Type Event Viewer in the Start menu to open it.
2. Navigate to the Logs: Look for logs under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.
3. Check Event IDs: Look for specific Event IDs related to controlled folder access:
   • 1123: Blocked controlled folder access event
   • 1124: Audited controlled folder access event
     These events will provide information about which folders were involved and the source of the access attempts that were blocked.

By checking these logs, you can identify the folders that are being protected and the applications that are trying to access them. If you need to stop these blocks, you may consider adjusting the settings for controlled folder access or adding trusted applications.

---

References:

• Protect important folders with controlled folder access