Advice Request Windows 10 has a built-in ransomware block, you just need to enable it

[Andy Ful]

@Andy Ful Is it possible to get a pop-up window option for this rule which allows the user to make an exception on a case-by-case basis? Thanks.

I am not sure what do you mean by an exception on a case-by-case basis.
How does this differ from making ASR exclusions?
You also can use the Warn setting and unblock the blocked executable for 24 hours. Most of the blocked executables are allowed by Microsoft after 48 hours.

 

[codswollip]

I am not sure what do you mean by an exception on a case-by-case basis

I could have been clearer... I was hoping for something along the lines of SmartScreen... a pop-up, notifying a recommended action, which I can accept or ignore.

 

[Andy Ful]

I could have been clearer... I was hoping for something along the lines of SmartScreen... a pop-up, notifying a recommended action, which I can accept or ignore.

You have it - use the Warn setting.
https://malwaretips.com/threads/configuredefender-utility-for-windows-10.79039/post-935829

Please continue your questions about ConfigureDefender in the above thread. We should here focus on CFA.

 

[NormanF]

The "Controlled folder access" feature in Windows 10 (and 11) is useless, because it blocks even Microsoft services and programs. Besides, you have to manually add each folder/program to the exclusion list, but the most annoying part is that Windows doesn't specify precisely which process was blocked.

I hoped that in Windows 11 Microsoft would have improved the feature, but it's not happened.

Its better for home users to run a third party AR solution. Easier to set up and configure and there's no danger of locking you out of Windows.

 

[ForgottenSeer 92963]

@NormanF Have you tried on Windows 11 also?

It might help to ignore low priority warnings in the Virus & Treat protection settings

Also when browsing the Protected Folders History of Windows 11, there was only one low priority warning since installing Windows 11 and updating it. It looks like the warnings for windows own processes are gone. Only one low priority block in 5 days for Rufus (burning ISO to USB)

 

[NormanF]

@NormanF Have you tried on Windows 11 also?

It might help to ignore low priority warnings in the Virus & Treat protection settings
View attachment 261353

Also when browsing the Protected Folders History of Windows 11, there was only one low priority warning since installing Windows 11 and updating it. It looks like the warnings for windows own processes are gone. Only one low priority block in 5 days for Rufus (burning ISO to USB)
View attachment 261354

Its disabled for a reason. Like with SAC, some things in Windows are best left untouched.

 

[oldschool]

I was surprised when Controlled Folder Access blocked Snipping Tool access to my Photos folder because I've never seen this before. I suppose MS has made changes to CFA. It was easily allowed via internal UI.

 

[nicos181987]

I tried again to use only Windows Defender with controlled-access folder after almost 2 years, and I was surprised to see that nothing changed; WD continues to block legitimate softwares.

As soon as I turned on controlled-folder access, Windows Defender instantly blocked the process "Dashboard.exe", the main process of Wester Digital dashboard software.

Really, Microsoft? Now I understand why you keep the option disabled by default...

 

[Andy Ful]

Really, Microsoft? Now I understand why you keep the option disabled by default...

Controlled Folder Access (CFA) requires some whitelisting. The user's applications blocked by CFA can be manually excluded. This requires some skills and effort, so CFA is disabled in default settings. If one likes an easy way, the option is Kaspersky (or another paid product) with dedicated anti-ransomware protection.

 

[oldschool]

As soon as I turned on controlled-folder access, Windows Defender instantly blocked the process "Dashboard.exe", the main process of Wester Digital dashboard software.

Did you try whitelisting it? I find that some (maybe many) CFA blocks don't interfere with main application processes and require no whitelisting at all.