Windows 10 anti-ransomware setting

User avatar
StuartR
Administrator
Posts: 12577
Joined: 16 Jan 2010, 15:49
Location: London, Europe

Windows 10 anti-ransomware setting

Post by StuartR »

I have just turned on the new anti-ransomware protection in Windows 10. I'll post something here if it leads to any issues.

How to activate the anti-ransomware protection in Windows 10 Fall Creators Update
StuartR


User avatar
HansV
Administrator
Posts: 78236
Joined: 16 Jan 2010, 00:14
Status: Microsoft MVP
Location: Wageningen, The Netherlands

Re: Windows 10 anti-ransomware setting

Post by HansV »

Thanks, looks promising! I turned it on after reading the article.
Best wishes,
Hans

User avatar
HansV
Administrator
Posts: 78236
Joined: 16 Jan 2010, 00:14
Status: Microsoft MVP
Location: Wageningen, The Netherlands

Re: Windows 10 anti-ransomware setting

Post by HansV »

Microsoft claims that
S1904.png
However, I find that no application whatsoever is allowed to save anything without adding that application explicitly. That includes Word, Excel etc. Not very user-friendly.
You do not have the required permissions to view the files attached to this post.
Best wishes,
Hans

User avatar
Rebel
4StarLounger
Posts: 557
Joined: 24 Jan 2010, 16:02
Location: Recently moved to Bracebridge - in the heart of Muskoka.

Re: Windows 10 anti-ransomware setting

Post by Rebel »

HansV wrote: I find that no application whatsoever is allowed to save anything without adding that application explicitly. That includes Word, Excel etc. Not very user-friendly.
I agree completely. I turned this feature on a few days ago, but soon became very frustrated. As you say, even MS apps, (including File Explorer) must be added individually to the "Allowed App" list. The concept is laudable, but the implementation seems not well thought out. :scratch:

Edited to add: Just had to turn the feature off to allow installation of the latest version of CCleaner.
John :canada:
A Child's Mind, Once Stretched by Imagination...
Never Regains Its Original Dimensions

User avatar
Jay Freedman
Microsoft MVP
Posts: 1313
Joined: 24 May 2013, 15:33
Location: Warminster, PA

Re: Windows 10 anti-ransomware setting

Post by Jay Freedman »

I have Windows 10 version 1709 build 17017.1000 (an Insider build) running in VMware, and I haven't had any such problems with Controlled Folder Access. I did have to enable Family Tree Maker and its backup, which want to write to the Program Files (x86) system folder, and a VMware Tools program that needed access somewhere, but nothing else has made a disallowed access attempt.
1.png
You do not have the required permissions to view the files attached to this post.

User avatar
StuartR
Administrator
Posts: 12577
Joined: 16 Jan 2010, 15:49
Location: London, Europe

Re: Windows 10 anti-ransomware setting

Post by StuartR »

I am adding programs as they fail. It's not very difficult, and over time it is creating a white list of programs that are allowed access to my data. I like it.
StuartR


JoeP
SilverLounger
Posts: 2051
Joined: 25 Jan 2010, 02:12

Re: Windows 10 anti-ransomware setting

Post by JoeP »

I like it too. All I've had to add so far is Outlook.

If you read articles about the feature, you'll find Microsoft took the approach that almost nothing is safe. I think that is better than to automatically whitelist a whole slew of apps. As Stuart said it is not difficult to add an allowed program.
Joe

User avatar
HansV
Administrator
Posts: 78236
Joined: 16 Jan 2010, 00:14
Status: Microsoft MVP
Location: Wageningen, The Netherlands

Re: Windows 10 anti-ransomware setting

Post by HansV »

On a related note: a new ransomware attack is on the rise: Bad Rabbit: Game of Thrones-referencing ransomware hits Europe.
Best wishes,
Hans

User avatar
StuartR
Administrator
Posts: 12577
Joined: 16 Jan 2010, 15:49
Location: London, Europe

Re: Windows 10 anti-ransomware setting

Post by StuartR »

I ran into a problem with Foxit PhantomPDF, the system tray shows an error notification in which I can't read the filename of the offending program, but it doesn't appear to be the main Foxit program (it's hard to be sure). I have allowed Foxit to write to the sensitive folders and we shall see what happens.
StuartR


User avatar
BobL
StarLounger
Posts: 88
Joined: 25 Jan 2010, 11:25
Location: Maine USA

Re: Windows 10 anti-ransomware setting

Post by BobL »

Ok, I'm running a bit senile over here up in Maine. I do remember turning it on, but can someone refresh my memory on how/where to turn it off?
I too am having every single app I run flag as not valid, but then I get very lost on 'how to find the app's folder' so I can 'add' that app - and even when I do find to find it the fooling thing doesn't seem to stick (yes it was on .exe file)...
Frustrated here and am much more comfortable with my sense of 'savy' in keeping me out of trouble.
BobL
The Other Bob from Maine
Image

User avatar
HansV
Administrator
Posts: 78236
Joined: 16 Jan 2010, 00:14
Status: Microsoft MVP
Location: Wageningen, The Netherlands

Re: Windows 10 anti-ransomware setting

Post by HansV »

Click the Start button, type 'windows defender'.
Select 'Windows Defender Security Center' from the search results.
Click the Settings button (the cog wheel) in the lower left corner.
Select 'Virus threat and protection settings'.
Scroll down and turn off 'Controlled folder access'.
Best wishes,
Hans

User avatar
BobL
StarLounger
Posts: 88
Joined: 25 Jan 2010, 11:25
Location: Maine USA

Re: Windows 10 anti-ransomware setting

Post by BobL »

Thank You Hans - worked perfectly (of course I knew it would). Now I get on to business as usual.
:cheers:
Not sure what we oldsters would do without you and this board...
BobL
The Other Bob from Maine
Image

User avatar
StuartR
Administrator
Posts: 12577
Joined: 16 Jan 2010, 15:49
Location: London, Europe

Re: Windows 10 anti-ransomware setting

Post by StuartR »

I find it very difficult to read the names of programs in the Windows 10 Action Centre, and you need the full name and file location in order to add the program to the Windows Defender list of allowed programs.

I eventually found these instructions for how to view these controlled folder events in the Windows event viewer.

Alternatively you can drill down in Event Viewer to find these...
Applications and Services > Microsoft > Windows > Windows Defender > Operational
Look for event ID 1123
StuartR


User avatar
Rebel
4StarLounger
Posts: 557
Joined: 24 Jan 2010, 16:02
Location: Recently moved to Bracebridge - in the heart of Muskoka.

Re: Windows 10 anti-ransomware setting

Post by Rebel »

This is really useful information Stuart. I used the Event Viewer path that you specified and I was able to find two applications that I hadn't added to the "Allowed App" list.
Thank you very much. :thumbup:
John :canada:
A Child's Mind, Once Stretched by Imagination...
Never Regains Its Original Dimensions