# Controlled folder access is enabled in block mode
Controlled folder access is a Microsoft Defender Antivirus protection that checks apps against a trusted list before allowing changes to protected…
Source: https://maester.dev/docs/tests/ZTA.41054
## Overview
Controlled folder access is a Microsoft Defender Antivirus protection that checks apps against a trusted list before allowing changes to protected folders. Microsoft describes it as a way to protect valuable data from malicious apps and threats such as ransomware, with default protected locations and administrator-defined additions. This matters because threat actors who reach execution often try to encrypt or destroy user and business files during the impact stage. If controlled folder access is disabled or only auditing, untrusted processes can still write to protected locations, so a ransomware event can complete before response teams intervene. The control is not a full backup strategy, and it can require allow rules for trusted line-of-business apps that write to user folders. It is still an important last endpoint barrier because it blocks unauthorized write activity where high-value files are commonly stored. This check uses the pinned MDATP Secure Score control `scid_2021` to evaluate the tenant-level Microsoft signal.
## Remediation
- [Protect important folders with controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-overview)
- [Configure controlled folder access](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-configure)
- [Monitor controlled folder access activity](https://learn.microsoft.com/en-us/defender-endpoint/controlled-folder-access-monitor)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | High |
| Effort to fix | Low |
| Impact on users | Medium |
| Pillar | SecOps |
| Category | Endpoint threat protection |
| Product | [Defender](/docs/tests/products/defender) |
| Feature | Endpoint antivirus |
| Area | Devices and endpoints |
| ATT&CK | [T1486](/docs/tests?mitre=T1486) Data Encrypted for Impact, [T1485](/docs/tests?mitre=T1485) Data Destruction |
| Licence | WINDEFATP, MDE_LITE |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.