How to Enable Ransomware Protection in Windows 11

What Controlled folder access does

Real-time protection watches files as they are opened and saved; Controlled folder access adds a second, blunter rule on top: any process that Windows does not consider reputable is flatly denied write access to the protected folders, no matter how it got onto the PC. Ransomware relies on exactly that write access — it must rewrite every document it wants to encrypt — so blocking unauthorized writers at the folder level stops the business model of the attack.

The feature is part of Microsoft Defender and is free in every edition, including Home. It is deliberately strict: a perfectly legitimate but little-known program can get blocked too, and every block lands in Protection history, where you can review it and whitelist the app if you trust it.

• Documents, Pictures, Videos, Music, Favorites and Desktop are protected the moment you flip the switch
• You can add your own folders — a projects folder on drive D, for example — under Protected folders
• Blocked attempts surface as “Unauthorized changes blocked” notifications and stay listed in Protection history
• Trusted apps can be whitelisted individually through “Allow an app through Controlled folder access”
• The feature requires Microsoft Defender as the active antivirus; with a third-party AV the settings are unavailable

How to turn it on step by step

Open Settings → Privacy & security → Windows Security, or type windows security in Start, then go to Virus & threat protection. Scroll to the Ransomware protection section and click Manage ransomware protection — expect a UAC prompt — and on the next screen turn on the Controlled folder access toggle. That is the whole setup: the default folders are protected immediately, and the same screen lets you add more folders and review what has been blocked.

Expect a short bedding-in period. The first backup sync, the first game save or the first photo export from an unfamiliar tool may trigger an “Unauthorized changes blocked” notification — that is the feature working, not a malfunction. Check Protection history, and if the blocked app is one you deliberately installed and trust, whitelist it; do not whitelist anything you cannot identify. On the same screen, Windows also suggests setting up OneDrive file sync, which is worth doing — version history in the cloud is what actually gets encrypted files back.

When it blocks a program you trust

To whitelist, open Ransomware protection → Allow an app through Controlled folder access → Add an allowed app; Windows conveniently lists recently blocked apps right there, so you rarely have to browse for the executable manually. Allow only programs you installed on purpose and can name — a cleaner such as Kleaner PRO or a known backup tool — because every allowed app regains full write access to the protected folders.

Keep the bigger picture in mind: Controlled folder access is a seatbelt, not a substitute for backups. Combine it with file history or a cloud sync with versioning, current Windows updates, and healthy skepticism toward email attachments, and the realistic ransomware risk on a home PC drops dramatically. If you ever need to check what was blocked and when, Protection history and the Microsoft-Windows-Windows Defender log in Event Viewer keep the full record.

Questions and Answers

Read next

All articles · FAQ