2

In short: Is it possible to list programs that Windows has denied access to a protected folder?

I recently enabled the Ransomware protection functionality in Windows Defender, adding a series of folders to the Controlled Folder Access list. Some of these folders are under Git version control (via Github Desktop), or synchronised using Syncthing (via SyncTrayzor). I've added the canonical versions of git.exe and syncthing.exe within C:/Program Files to the Allowed App list, but I now receive messages telling me that windows has blocked attempts to access files in protected folders by C:/Users/.../git.exe and C:/Users/.../syncthing.exe.

Annoyingly, the ellipsis hides most of the path to the executable file. A windows search of my user directory eventually turns up a number of copies of git.exe, and it's not immediately clear which of these was trying to edit the files. Ransomware protection's limited user interface means it takes ages to add each file individually, and this seems like a poor security choice: a smart attacker might entitle their malware git.exe to trick me into allowing access.

How can I see the full path of the blocked file (particularly after the notification prompt has disappeared from my screen)?

I can't see anything relevant in the Windows event log.

1

You can see the list of recently blocked apps in Windows Defender settings.

To see the list of apps that are blocked, click on the Add an allowed app button, and click Recently blocked apps.

via How to Configure Controlled Folder Access to Stop "Unauthorized changes blocked" Notifications

enter image description here

Alternately, open a Command Prompt window to run this command:

wevtutil qe "Microsoft-Windows-Windows Defender/Operational" /q:"*[System[(EventID=1123)]]" /c:15 /f:text /rd:true | findstr /i "process name:"

This shows the list of the last 15 items blocked by Defender's Controlled Folder Access.

enter image description here

| improve this answer | |
  • When I click "Add an allowed app", I just see an "open file" dialog box: I don't see the popup displayed in your screenshot. – ms609 Jun 7 '19 at 7:19
  • 1
    The new option was introduced in v1809 (i think). For older builds, you can see the file names in the Event Viewer, or use the PowerShell script in that article. – w32sh Jun 7 '19 at 8:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.