Skip to content

defender-endpoint-demonstration-controlled-folder-access-test-tool.md

Latest commit

 

History

History
93 lines (65 loc) · 2.65 KB

defender-endpoint-demonstration-controlled-folder-access-test-tool.md

File metadata and controls

93 lines (65 loc) · 2.65 KB

title: Microsoft Defender for Endpoint Controlled folder access (CFA) demonstration test tool description: See how malicious apps and threats are evaluated and countered by Microsoft Defender Antivirus. search.appverid: met150 ms.service: defender-endpoint ms.author: lwainstein author: limwainstein ms.localizationpriority: medium manager: bagol ms.reviewer: yongrhee audience: ITPro ms.collection:

  • m365-security
  • tier2
  • demo ms.topic: article ms.subservice: asr ms.date: 03/10/2025 appliesto:
    • Microsoft Defender for Endpoint Plan 1
    • Microsoft Defender for Endpoint Plan 2

Controlled folder access (CFA) demonstration test tool (block script)

Controlled Folder Access helps you protect valuable data from malicious apps and threats, such as ransomware. All apps (any executable file, including .exe, .scr, .dll files and others) are assessed by Microsoft Defender Antivirus, which then determines if the app is malicious or safe. If the app is determined to be malicious or suspicious, then it will not be allowed to make changes to any files in any protected folder.

Scenario requirements and setup

  • Windows 10, version 1709 (build 16273) or newer

  • Microsoft Defender Antivirus (active mode)

PowerShell commands

Set-MpPreference -EnableControlledFolderAccess <State>

Rule states

State Mode Numeric value
Disabled = Off 0
Enabled = Block mode 1
Audit = Audit mode 2

Verify configuration

Get-MpPreference

Scenario

Setup

Download and run this setup script. Before running the script set execution policy to Unrestricted using this PowerShell command:

Set-ExecutionPolicy Unrestricted

You can perform these manual steps instead:

  1. Turn on CFA using PowerShell command:
Set-MpPreference -EnableControlledFolderAccess Enabled
  1. Download the CFA test tool
  2. Execute the PowerShell commands above

Scenario: Use the CFA test tool to simulate an untrusted process writing to a protected folder

  1. Launch CFA test tool
  2. Select the desired folder and create file
  • You can find more information here.

Clean-up

Download and run this cleanup script. You can perform these manual steps instead:

Set-MpPreference -EnableControlledFolderAccess Disabled

See also

Controlled folder access