Turn On Defender Ransomware Protection (Controlled Folder Access) via PowerShell

Use Set-MpPreference to enable controlled folder access so only trusted apps can modify your documents.

WindowsdefendersecuritypowershellLow risk

Run `Set-MpPreference -EnableControlledFolderAccess Enabled` in an elevated PowerShell window.

01Command

Command

$ Set-MpPreference -EnableControlledFolderAccess Enabled

02What it does

Microsoft Defender includes a ransomware shield called Controlled Folder Access: once enabled, untrusted apps are blocked from writing to your Documents, Pictures, Videos, and Music folders, so ransomware can't encrypt them silently. The Settings app hides this switch behind menus and some editions hide it entirely, but one PowerShell command turns it on. Adding specific folders or allowed apps is done with -AddProtectedFolder and -AddControlledFolderAccessAllowedApplication.

03Risk

RiskLow risk

Requirements需要管理员权限的 PowerShell；受保护文件夹默认为文档、图片、视频、音乐；第三方应用首次写入需手动放行。

!Warning: Expect some friction: legitimate tools (older editors, game mods, sync clients) may get blocked the first time they write to a protected folder — you'll see a notification and can allow the app afterwards.

04Undo

Undo

$ Set-MpPreference -EnableControlledFolderAccess Disabled

05Sources

Protect important folders with controlled folder access | Microsoft Learn
Microsoft · vendor-doc · 2026-09-17
Evidence: Controlled folder access lets only trusted apps make changes to protected folders; it can be enabled via Set-MpPreference -EnableControlledFolderAccess.

Last verified: 2026-09-18 · Category: Security & Privacy

06Related solutions

Verify Code Signatures with Get-AuthenticodeSignature

Windowssignaturesecuritypowershell

Read the Authenticode signature status and signer of any executable or script in PowerShell.

Low risk ✓ 2026-09-17

Fix 'scripts is disabled on this system' with Set-ExecutionPolicy

WindowsTerminaldevelopersecurity

Understand PowerShell's execution policy scopes and set the one that lets you run your own local scripts without gutting the security model.

Medium risk ✓ 2026-09-17

Grep on Windows: Select-String

Windowssearchtextpowershell

Search inside text files and logs with regex, returning file, line number and match.

Low risk ✓ 2026-09-17