# Script to manage controlled folder access on Windows devices In the world of cybersecurity, ransomware attacks are widespread, continuing to increase every year. To combat such threats, organizations need to set up a mechanism to protect their valuable data from malicious intrusions. Available with **Microsoft Defender Exploit Guard**, *Controlled folder access* is an anti-ransomware feature designed to primarily protect your files from undesirable changes by suspicious software. Once enabled, it tracks and blocks any threat attempts in real time. With Hexnode UEM, device admins can remotely run scripts to manage the controlled folder access using the [Execute Custom Script](https://www.hexnode.com/mobile-device-management/help/how-to-run-scripts-on-mac-using-hexnode-mdm/) action. Disclaimer: The sample scripts provided below are adapted from third-party open-source sites. Enable controlled folder access ------------------------------- Execute the script below to enable *Controlled folder access*. Once enabled, you can manage which folders can be modified by untrusted apps. You can also add new applications to a trusted list, permitting only those apps to make changes to specific folders. [![Controlled folder access – Enabled](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/04/Controlled-folder-access-enabled.jpeg)](https://cdn.hexnode.com/mobile-device-management/help/wp-content/uploads/2023/04/Controlled-folder-access-enabled.jpeg) Script to enable controlled folder access Set-MpPreference -EnableControlledFolderAccess Enabled 1 Set-MpPreference -EnableControlledFolderAccess Enabled Disable controlled folder access -------------------------------- Execute the script below to disable *Controlled folder access*. [![Controlled folder access – Disabled](https:2023/04/Controlled-folder-access-disabled.jpeg)](https:2023/04/Controlled-folder-access-disabled.jpeg) Script to disable controlled folder access Set-MpPreference -EnableControlledFolderAccess Disabled 1 Set-MpPreference -EnableControlledFolderAccess Disabled Add protection for folder location ---------------------------------- Windows system folders such as Documents, Pictures, Videos, Music, Desktop and Favorites are protected by default on enabling Controlled folder access. This means that any unknown or untrusted apps won’t be able to access or modify content in these folders. Furthermore, if you add more folders, they will also receive this same level of protection. Execute the script below to add any other paths you want to protect. [![Add protection for folder location](https:2023/04/Add-protection-for-folder-location.jpeg)](https:2023/04/Add-protection-for-folder-location.jpeg) Script to add protection for folder locations Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\\Admin" 1 Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\\Admin" Remove protection for folder location ------------------------------------- Windows system folders are protected by default and cannot be avoided. However, you can execute the script below to remove any additional paths you had added for protection. Script to remove protection for folder locations Remove-MpPreference -ControlledFolderAccessProtectedFolders "D:\\Admin" 1 Remove-MpPreference -ControlledFolderAccessProtectedFolders "D:\\Admin" Allow apps through controlled folder access ------------------------------------------- Controlled folder access detects unfriendly apps and blocks the write access (to protected folders) for such apps. However, if any apps you trust are blocked, you can execute the script below to allow such apps to access the protected folders. [![Allow apps through controlled access](https:2023/04/Allow-apps-through-controlled-folder-access.jpeg)](https:2023/04/Allow-apps-through-controlled-folder-access.jpeg) Script to allow apps for controlled folder access Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" 1 Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" Deny apps from controlled folder access --------------------------------------- Execute the script below to deny apps from accessing the protected folders. Script to deny apps from controlled folder access Remove-MpPreference -ControlledFolderAccessAllowedApplications "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" 1 Remove-MpPreference -ControlledFolderAccessAllowedApplications "C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" Add a folder to Microsoft Defender exclusion -------------------------------------------- Execute the script below to add folders you want to exclude from Microsoft Defender anti-virus scans. [![Add Defender exclusion folder](https:2023/04/Add-Defender-exclusion-folder.jpeg)](https:2023/04/Add-Defender-exclusion-folder.jpeg) Script to add folders to Defender exclusions Add-MpPreference -ExclusionPath "D:\\Admin" 1 Add-MpPreference -ExclusionPath "D:\\Admin" Remove a folder from Microsoft Defender exclusion ------------------------------------------------- Folders that were previously excluded from Microsoft Defender anti-virus scans can be included by executing the below script. Once the script is executed, these folders will undergo Microsoft Defender anti-virus scans. Script to add folders to Defender exclusions Remove-MpPreference -ExclusionPath "D:\\Admin" 1 Remove-MpPreference -ExclusionPath "D:\\Admin" Add a file to Microsoft Defender exclusion ------------------------------------------ Execute the script below to add files you want to exclude from Microsoft Defender anti-virus scans. [![Add Defender exclusion files](https:2023/04/Add-Defender-exclusion-files.jpeg)](https:2023/04/Add-Defender-exclusion-files.jpeg) Script to add files to Defender exclusions Add-MpPreference -ExclusionExtension "D:/Admin/file.txt" 1 Add-MpPreference -ExclusionExtension "D:/Admin/file.txt" Remove a file from Microsoft Defender exclusion ----------------------------------------------- Files that were previously excluded from Microsoft Defender anti-virus scans can be included by executing the below script. Once the script is executed, these files will undergo Microsoft Defender anti-virus scans. Script to remove files from Defender exclusions Remove-MpPreference -ExclusionExtension "D:/Admin/file.txt" 1 Remove-MpPreference -ExclusionExtension "D:/Admin/file.txt" Notes:- Controlled folder access is an intrusion-prevention feature included in the *Microsoft Defender Antivirus* suite. Therefore, if you are using a third-party antivirus, this security feature may not be available. - It is recommended to manually validate the script execution on a system before executing the action in bulk. - Hexnode will not be responsible for any damage/loss to the system on the behavior of the script.