How to Enable or Disable Controlled Folder Access in Windows 11 Prevent apps from making unwanted changes. Here’s how to enable or disable Controlled Folder Access in Windows 11. Before we begin, be sure to subscribe to NinjaOne’s IT Video Hub and our YouTube channel for more tech content like this. What is Controlled Folder Access (CFA)? Controlled Folder Access, or CFA for short, is a security feature built into Microsoft Defender Antivirus to ensure that unauthorized applications do not modify protected user folders. For admins of managed environments, it is crucial that this feature is properly configured to strengthen their security framework. To enable or disable CFA, there are four methods you can follow. Methods to Modify Controlled Folder Access (CFA) The most straightforward way is through the Windows Security app. Open Windows Security and click on Virus & threat protection on the left side of the window. Scroll down, and under the Ransomware protection section, click on Manage ransomware protection. From here, you can toggle CFA on or off. For those managing enterprise environments, instead of individual devices, you can try modifying your Group Policy. Run the Group Policy Editor and navigate to the CFA policy by clicking on the following path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access. Next, double-click on “Configure controlled folder access” and set the policy to Enabled. Then, you can choose one of three enforcement modes: Enable controlled folder access, Disable controlled folder access, and Audit Mode. Click Apply, and save changes by using gpupdate /force on the Command Prompt or restarting the system. For remote management and automated deployments, you can use Windows PowerShell with administrative privileges. First, check the CFA status by running Get-MpPreference | Select ControlledFolderAccessEnabled. Value 0 means it is disabled, 1 means it’s enabled, and 2 means it’s in Audit mode. Once you know the status, use Set-MpPreference -EnableControlledFolderAccess 1 to enable, Set-MpPreference -EnableControlledFolderAccess 0 to disable, or Set-MpPreference -EnableControlledFolderAccess 2 to set to Audit mode. Finally, if you are deploying settings via Intune custom policies, use Registry Editor. Run Registry Editor, and navigate to... Create a new DWORD value named “EnableControlledFolderAccess” and set the value to 0 to disable, 1 to enable, or 2 to set to Audit mode. Apply changes by restarting your PC or running sc stop WinDefend && sc start WinDefend in Command Prompt. Activating Controlled Folder Access improves your PC’s security measures from unwanted changes to your files. For more information, check out our official blog post on How to Enable or Disable Controlled Folder Access in Windows 11, linked in the description below.