In Windows 10, the Windows Defender feature "Controlled Folder Access" (added in 1709) prevents unauthorized changes to (among others) the folder %userprofile%\Desktop. According to Windows Notifications & Event Log, Firefox is attempting such unauthorized change - about 5 times a day, no correlation to user input.

What is it that Firefox does to trigger this Alert, and how do i disable that?

Windows Event Log reads (corresponding desktop notification is truncated, but equals otherwise):

C:\Users\Name\AppData\Local\Mozilla Firefox\firefox.exe has been blocked from modifying %userprofile%\Desktop by Controlled Folder Access.
Detection time: 2018-03-26T10:16:18.846Z
User: PC101\Name
Path: %userprofile%\Desktop
Process Name: C:\Users\Name\AppData\Local\Mozilla Firefox\firefox.exe
Signature Version: 1.263.1182.0
Engine Version: 1.1.14600.4
Product Version: 4.12.17007.18022

Unsuccessful solutions:

  • start Firefox in Safe Mode to exclude actions done by extensions (issue persists)
  • Checking if quick access/default&last download dir/MRU contains a Controlled folder (it does not)
  • use Set-MpPreference -EnableControlledFolderAccess AuditMode to change the policy from enforcement mode to audit only and check the folder whenever the alert is displayed (no change: Desktop remains an empty folder)
  • Have you tried running FF with all addons disabled?, is it possible that it wants to create a shortcut/icon? – arana Mar 27 '18 at 15:27

The Desktop folder is frequently designated as the destination for Firefox downloads (I think it's one of the default choices in a newly-installed Firefox), and some Firefox extensions might be configured to use that folder similarly. If such is the case, Firefox initialization would likely include opening a file handle to "Downloads" that specifies write access, and could trigger the Controlled Folder Access warning. The Windows Defender Security Center in Settings has provision for customizing the list of protected folders and authorized apps.

  • Default save location is browser.download.dir, the most recent save location is browser.download.lastDir. As neither of those point to Desktop (and the default for new installs is Downloads), this explanation sounds implausible. – anx Mar 28 '18 at 4:21

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.