Trials and Tribulations with Controlled folder access on Windows 11
I was poking around in the Windows 11 security setting so my gaming desktop PC and I came across an untoggled switch. Controlled folder access, it claims to “Protect files, folders, and memory areas on your devices from unauthorized changes by unfriendly applications”.
Huh, well that sounds good to me.
So, I switched it on to see what would happen.
The first app it blocked was LM Studio. This app is supplied to my machine through the AI Bundle in AMD’s driver installer. I use it to run a local copies of GPT-OSS and Gemma 4, but mostly to poke around with what’s possible on my RX 9070 XT. It has a feature where it will start in the system tray when you login. Which leads to this:
Interestingly other apps have this same behavior and are blocked by Windows like AMDRSServ.exe, DeviceCensus.exe, msedge.exe, AceCombat8.exe, DARK.EXE, clinfo.exe, and RadeonSoftware.exe.
It looks like common denominator here is that they try to access the root folder of my C drive.
Which would make sense if I were Randsomeware. Encrypting the C drive seems like it would be an important task.
But as someone who, for unrelated reasons, is developing a desktop app targeting Windows 11: how do I avoid triggering this Protected memory access feature? I don’t want to scare my users.
Reading through Microsoft’s documentation it looks like we can avoid triggering a block by not using these folders:
- Hard driver boot sectors like C:\
- C:\Users\ and any sub-folder
But it turns out that that’s not enough. There is an unreported whitelist that Microsoft maintains, “By default, Microsoft Defender Antivirus automatically trusts apps based on their prevalence and reputation, and adds them to the allowed list.”
Thus, it looks like there is not a lot we can do to avoid getting blocked by the CFA feature in Windows 11. Except for building a popular app and avoiding code that writes files to the root director or the user’s directories. Harrumph.
Looking at my work laptop I can see that CFA is disabled by our group policy. Which after this experiment makes sense, and so I've disabled it again on my gaming machine. It's a shame that there isn't a better way to combat randsomware attacks.