In Windows 10, the Windows Defender feature "Controlled Folder Access" (added in 1709) prevents unauthorized changes to (among others) the folder
According to Windows Notifications & Event Log, Firefox is attempting such unauthorized change - about 5 times a day, no correlation to user input.
What is it that Firefox does to trigger this Alert, and how do i disable that?
Windows Event Log reads (corresponding desktop notification is truncated, but equals otherwise):
C:\Users\Name\AppData\Local\Mozilla Firefox\firefox.exe has been blocked from modifying %userprofile%\Desktop by Controlled Folder Access. Detection time: 2018-03-26T10:16:18.846Z User: PC101\Name Path: %userprofile%\Desktop Process Name: C:\Users\Name\AppData\Local\Mozilla Firefox\firefox.exe Signature Version: 1.263.1182.0 Engine Version: 1.1.14600.4 Product Version: 4.12.17007.18022
- start Firefox in
Safe Modeto exclude actions done by extensions (issue persists)
- Checking if quick access/default&last download dir/MRU contains a Controlled folder (it does not)
Set-MpPreference -EnableControlledFolderAccess AuditModeto change the policy from enforcement mode to audit only and check the folder whenever the alert is displayed (no change: Desktop remains an empty folder)