Ransomware can lock up photos, documents, and years of files in minutes, which is why many Windows users search for Windows ransomware protection before it happens to them, not after.
The good news is that Windows already has a built-in tool for this called Controlled folder access, found inside Windows Security, and it can be turned on in just a few clicks.
This article walks through how to find it, turn it on, protect extra folders, allow a trusted app if it gets blocked, and what to do if the setting is missing or causing problems.
Contents
- 🔍 What to Check Before You Turn It On
- ⚙️ Step-by-Step: Turning On Controlled Folder Access
- 📁 Adding Extra Protected Folders
- ✅ Allowing a Trusted App That Gets Blocked
- 🛡️ How This Fits With Backups and Other Protection
- ⚠️ If the Setting Is Missing or Not Working
- 🧩 Common Mistakes and How to Avoid Them
🔍 What to Check Before You Turn It On
Before changing any setting, it helps to understand what Controlled folder access actually does. It watches a list of protected folders, such as common document and picture locations, and blocks unapproved or untrusted apps from changing files inside them.
This matters because ransomware typically works by quietly encrypting personal files, then demanding payment to unlock them. By stopping unknown programs from writing to those folders in the first place, Windows can interrupt that process before it spreads.
It is important to set expectations correctly, though. This feature is an extra layer of defense, not a guarantee against every ransomware attack, and it is not a replacement for regular backups.
It also depends on Microsoft Defender Antivirus being active on the device. If another antivirus program has taken over real-time protection, this setting may behave differently or be unavailable, and that can vary by device and version.
💡 Key point: Controlled folder access blocks unapproved apps from writing to protected folders, but it works best alongside backups, not instead of them.
⚙️ Step-by-Step: Turning On Controlled Folder Access
The steps below are the same for Windows 10 and Windows 11, though menu wording can shift slightly between updates.
Start by opening the Start menu and typing Windows Security into the search bar, since renamed menus can usually still be found this way.
- Open Start, search for Windows Security, and open the app.
- Select Virus & threat protection from the main menu.
- Scroll down to Ransomware protection and select Manage ransomware protection.
- Under Controlled folder access, switch the toggle to On.
- Approve the User Account Control prompt if Windows asks for confirmation.
Once the toggle is on, Windows begins actively monitoring the default protected folders without any further action needed. There is no save button to click separately; the switch takes effect immediately.
💡 Field tip: A quick way to confirm it actually turned on is to reopen Manage ransomware protection within a minute and check that the toggle still shows On. If it has silently reset to off, that usually points to an organization-managed device or a conflicting antivirus program rather than a mistake on your part.
Because this setting touches system-level file permissions, it is worth treating it with the same care as any security or privacy setting. If something looks unfamiliar on your specific device, checking the Windows Security app help section or Microsoft support directly is a reasonable next step.
📁 Adding Extra Protected Folders
Windows automatically protects certain common folders by default, but that list can vary depending on the device and version.
If important files live outside those default locations, such as a secondary drive folder or a custom work directory, adding them manually closes that gap.
- From the Manage ransomware protection page, select Protected folders.
- Approve the User Account Control prompt if it appears.
- Choose Add a protected folder.
- Browse to the folder and select it to add it to the list.
Windows lets you add more than one protected folder, so it is reasonable to add every location that holds files worth protecting, such as a folder of scanned documents or financial records.
💡 Field tip: A common point of confusion is assuming an entire drive is protected once one folder on it is added. Controlled folder access protects the specific folders listed, not the whole drive automatically, so each important folder needs to be added individually.
✅ Allowing a Trusted App That Gets Blocked
Once Controlled folder access is active, some legitimate programs may be blocked from saving or editing files in protected folders, especially older software or less common tools.
This is expected behavior, not a sign that something is broken. Windows is simply being cautious about any program it does not already recognize as safe.
- Open Manage ransomware protection and select Allow an app through Controlled folder access.
- Approve the User Account Control prompt.
- Choose Add an allowed app.
- Select the app from Recently blocked apps if it appears there, or browse for its program file directly.
Only approve an app after confirming it is trustworthy, since this allows that specific app to change files in protected folders going forward. Checking Windows Security notifications or the blocked-app list first can confirm whether the app was actually blocked by this feature, rather than failing for an unrelated reason.
⚠️ Watch out: Adding an app you do not recognize, or one downloaded from an unfamiliar source, can undo the protection this feature is meant to provide.
If a familiar app like a photo editor or document tool suddenly cannot save files, checking this blocked list is usually the fastest way to diagnose it before assuming the software itself is broken.
🛡️ How This Fits With Backups and Other Protection
Controlled folder access is designed to work alongside other habits, not replace them. Microsoft recommends keeping Windows updated and maintaining separate backups of important files.
Services like OneDrive offer file versioning along with ransomware detection and recovery features, which can serve as an additional safety net if local files are ever affected despite other protections.
Because file backups often involve personal documents or account sign-ins, it is a good idea to check the backup service’s official help page or contact its support team for exact setup details specific to that account.
No single setting can fully substitute for having a separate copy of important files somewhere else. Think of Controlled folder access as a gate that stops many unauthorized changes, while a backup is the safety copy that exists even if something gets through.
💡 Key point: Pairing Controlled folder access with regular backups covers two different failure points, rather than relying on one setting to do everything.
⚠️ If the Setting Is Missing or Not Working
Sometimes the ransomware protection option cannot be found at all, which usually points to one of a few specific causes.
If Microsoft Defender Antivirus is not the active real-time protection on the device, perhaps because another antivirus program has taken over, the ransomware protection menu may not appear the same way.
On a work or school computer, an organization’s administrator may control or restrict this setting entirely. In that case, checking with the IT administrator is the appropriate next step rather than trying to force a change.
If a suspected infection has already occurred, Microsoft advises scanning the PC with Windows Security before attempting to recover any files, and specifically advises against paying a ransom.
💡 Field tip: Many people stop here because they assume a missing menu means something is permanently broken. In most cases it simply means a different antivirus app is currently active, and switching back to Microsoft Defender Antivirus as the primary protection (if that is an option on the device) will usually bring the ransomware protection menu back.
🧩 Common Mistakes and How to Avoid Them
One frequent mistake is turning on Controlled folder access and never checking the protected folder list, which means important files outside the defaults stay unprotected without the user realizing it.
Another is allowing an unfamiliar app through the block just to make an error message disappear, without first confirming the app is something the user actually installed on purpose.
A third mistake is treating this feature as a full ransomware solution and skipping backups entirely, when Microsoft is clear that it works best as one layer among several.
| Mistake | Better Approach |
|---|---|
| Assuming all folders are protected by default | Check Protected folders and add any extra locations manually |
| Allowing any blocked app without checking it | Confirm the app and its source before adding it to the allowed list |
| Relying only on this setting | Keep Windows updated and maintain a separate backup |
| Paying a ransom after an infection | Scan with Windows Security first; avoid paying, per Microsoft guidance |
Reviewing the protected and allowed lists occasionally, rather than only at setup, helps keep the feature aligned with how the device is actually being used over time.
🙋 Frequently Asked Questions
Q. Does Controlled folder access slow down the computer?
If you notice the computer feeling slower after turning it on, checking Microsoft’s official support pages or contacting support for device-specific details is the safer path.
Q. Will this protect files stored on an external USB drive?
Protection applies to folders that have been added to the protected list; a folder on an external drive can be added manually the same way as any other folder, following the same steps described earlier.
Q. Can I turn off Controlled folder access later if it causes problems?
Yes, the same toggle used to turn it on under Manage ransomware protection can be switched back off at any time.
Q. Does this feature work if I use a different antivirus instead of Microsoft Defender?
Availability can depend on which antivirus is actively providing real-time protection on the device, and this can vary by setup, so checking within Windows Security is the most reliable way to confirm current status.
Q. What happens to files already encrypted by ransomware?
Turning on this setting does not undo existing damage; Microsoft advises scanning with Windows Security first and recommends against paying a ransom.
Q. Is this the same on Windows 10 and Windows 11?
The steps are described as the same for both versions, though exact menu wording and layout can differ slightly depending on the specific update installed.
Q. Do I need this if I already use OneDrive backup?
OneDrive offers its own file versioning and ransomware detection and recovery features, but using both together covers different parts of the process, from blocking unauthorized changes to recovering files afterward.
📌 Quick Summary
| Item | Details |
|---|---|
| Feature name | Controlled folder access, inside Windows Security |
| Where to turn it on | Virus & threat protection → Manage ransomware protection |
| Add more folders | Protected folders → Add a protected folder |
| Fix a blocked app | Allow an app through Controlled folder access → Add an allowed app |
| Works with | Regular backups, OneDrive versioning and recovery, Windows updates |
| Common cause if missing | Defender not active, or device managed by an organization |
| If infection is suspected | Scan with Windows Security first; avoid paying a ransom |
A simple first step is opening Windows Security today and checking whether Controlled folder access is already on, then adding any folders that matter most before assuming they are covered.
This article is based on public information available at the time of writing. Menus and steps may change with app or device updates.