“Unauthorized changes blocked” in Windows Security: what it means and how to fix it

Applies to Windows 11 and Windows 10 PCs that use Microsoft Defender Antivirus. Menu names follow Microsoft’s current Windows Security support article and its Microsoft Learn pages on controlled folder access. Where a tip is ours and not in Microsoft’s documentation, we say so.

What the message means

Controlled folder access is off by default, so if you see this message, it was turned on at some point, by you, by a security checklist or by your organisation. Once it is on, Microsoft Defender lets only trusted apps change files in protected folders. Microsoft says Defender trusts most apps automatically based on how common they are and their reputation. Anything else that tries to write to a protected folder is stopped, and Windows shows a notification.

That is exactly how ransomware works: it opens your documents and photos and overwrites them with encrypted copies. Controlled folder access does not judge whether an app is malicious; it only checks whether the app is on the trusted list. So the block can mean one of two things: a legitimate program that Defender doesn’t know well, such as a new game, a small utility or an older editing tool, or something you really don’t want touching your files.

Microsoft lists the default protected folders as Documents, Pictures, Videos, Music and Favorites, for your account and the Public folders, plus the disk’s boot sectors. Its Windows Security support article also names Desktop. If OneDrive or a policy has moved these folders, Microsoft says the protection follows them to the new location. You cannot remove the default folders, but you can add more.

Match your situation

What you see	What it usually means	What to do
A program you just installed can’t save files	A trusted but less common app was blocked	Find the app, then allow it
A game can’t write saves to Documents	The game’s process is not on the trusted list	Allow the game’s .exe, not the launcher folder
The blocked file is in a folder you don’t recognise, such as Temp	Possibly unwanted or malicious software	Don’t allow it; run a malware scan
The same app is blocked again after an update	The app moved to a new folder or file name	Allow the new path
The notification shows several times a day for Windows tools	A built-in tool or script needs access	Check the path carefully before allowing
The Controlled folder access toggle is greyed out	Another antivirus or your organisation controls it	See the last section

Step 1: Find out which app was blocked

The notification itself is the quickest route. Select it while it is on screen and Windows Security opens the details, including the full path of the program that was blocked and the folder it tried to change. Write down that path; you need it in the next steps.

If the notification has gone, open Windows Security and select Protection history. Microsoft says controlled folder access blocks are recorded there. Open the newest entry to see the app and the protected location. The wording of the entry can differ between Windows versions, so look for the time the problem happened rather than a specific title.

For a longer record, use Event Viewer. Microsoft’s monitoring page lists event ID 1123 for a blocked controlled folder access event, 1124 for an audited one and 5007 for a change to Defender settings.

1. Select Start, type Event Viewer and open it.
2. Go to Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational.
3. Select Filter Current Log on the right, enter 1123 and select OK. Open an event to read its details, which should include the blocked program and the file it tried to change.

Step 2: Decide whether to trust the app

This is the step that matters most. Microsoft warns that any app you allow can change files in your protected folders, and if that app is later compromised, your data is at risk. Allowing an unknown program removes the protection for exactly the files ransomware targets.

These checks are our suggestions, not Microsoft’s, but they catch most cases:

• Do you recognise the program name and its folder? Programs normally live under C:\Program Files or C:\Program Files (x86). A random-looking file name in AppData\Local\Temp or the Downloads folder deserves suspicion.
• Did you just do something that explains it? Saving a file in a newly installed app, running a game for the first time or updating a program are all normal triggers.
• Is the program signed? Right-click the .exe, select Properties and check for a Digital Signatures tab naming a publisher you know. A missing signature doesn’t prove malware, but a known publisher is reassuring.
• When in doubt, scan first. Run a full scan or a Microsoft Defender Offline scan before allowing anything. Our malware scan guide walks through both.

Warning: never allow a program just to make the notification go away. If you can’t identify it, leave it blocked. A blocked legitimate app costs you a saved file; an allowed ransomware sample can cost you every document you have.

Step 3: Allow a trusted app in Windows Security

Once you are sure the program is safe, add it to the allowed list. Controlled folder access must be on for this option to appear.

1. Open Windows Security and select Virus & threat protection.
2. Under Ransomware protection, select Manage ransomware protection. On some builds you reach the same page through Manage settings and then Manage controlled folder access.
3. Select Allow an app through Controlled folder access and choose Yes at the User Account Control prompt.
4. Select Add an allowed app, then Recently blocked apps. Pick the app whose path matches the one you wrote down.
5. If it is not listed, select Browse all apps and select the program’s .exe file.

Microsoft says an allowed app takes effect when the app starts, so close and reopen the program before you test it. The allow covers the program only at that exact location. If an update installs the app into a new versioned folder, it may be blocked again and you’ll need to add the new path.

If you just need one file saved right now, Microsoft’s simpler workaround is to save it somewhere outside the protected folders, then move it later once the app is allowed.

Step 4: Allow an app with PowerShell

PowerShell is handy when you need to add several programs, or the same program on several PCs. Open PowerShell as administrator and run, with your own path:

Add-MpPreference -ControlledFolderAccessAllowedApplications "C:\Program Files\Example\example.exe"

Use the full path and file name. Microsoft’s configuration page says environment variables such as %ProgramFiles% and wildcards in the folder part of the path also work, which helps with apps that install into a new folder on every update.

Two cautions from the same page. First, use Add-MpPreference, not Set-MpPreference: the Set version replaces the whole allowed list. Second, to take an app off the list later, use Remove-MpPreference with the same parameter and path. To review what you have allowed, run:

(Get-MpPreference).ControlledFolderAccessAllowedApplications

Be especially careful with script engines. Microsoft notes that the only way to let PowerShell write to protected folders is to add it as an allowed app, and allowing PowerShell means any script it runs gets the same access.

Step 5: Add your own protected folders

The defaults miss folders many people use for important work, such as a project folder on a second drive. Adding them extends the same protection.

1. In Windows Security, go to Virus & threat protection > Manage ransomware protection.
2. Select Protected folders and choose Yes at the User Account Control prompt.
3. Select Add a protected folder and pick the folder. Repeat for each one.

In PowerShell as administrator, Add-MpPreference -ControlledFolderAccessProtectedFolders "D:\Projects" does the same. Expect more blocks after adding folders that your apps write to often, such as a game library, and allow those apps as they come up.

The same Ransomware protection page also offers ransomware data recovery with OneDrive. Microsoft describes it as a way to keep a copy of important files you can restore after an attack. Controlled folder access reduces the risk; a backup is what saves you if something gets through.

Should you turn Controlled folder access off?

Usually not. Turning it off removes a layer that specifically protects your documents from ransomware, and the usual problem, one legitimate app being blocked, is solved by allowing that app. Consider turning it off only when:

• you rely on several programs that are blocked every time they update and you can’t keep up with the allowed list, or
• you are troubleshooting and want to confirm that controlled folder access is the cause, in which case turn it back on straight afterwards.

To switch it off, go to Virus & threat protection > Manage ransomware protection and set Controlled folder access to Off, then confirm the User Account Control prompt. Leave your other Defender protection, especially real-time protection, on.

There is a middle ground for advanced users. Microsoft’s configuration page lists an audit mode, set with Set-MpPreference -EnableControlledFolderAccess AuditMode in an administrator PowerShell window. Changes are allowed but logged as event 1124, so you can see what would be blocked before you turn blocking back on with Set-MpPreference -EnableControlledFolderAccess Enabled. Audit mode does not protect your files, so treat it as a short test, not a permanent setting. The Windows Security app itself only offers On and Off.

If the settings are missing or greyed out

Microsoft says controlled folder access works only when Microsoft Defender Antivirus is your active antivirus and real-time protection is on. If another antivirus is installed, Defender steps back and the ransomware settings may be missing or unavailable; use that product’s own ransomware protection instead. If Windows Security says Defender is off when you don’t expect it, see our guide to the Defender turned off notification.

On a work or school PC, controlled folder access is often set by Group Policy, Intune or another management tool, and local changes may be locked or undone. In that case, send the blocked app’s path to your IT team rather than looking for a way around the policy. This is our general advice; Microsoft’s pages describe the policy settings but not what users see.

If Windows Security won’t open at all, fix that first with our Windows Security not opening guide. And if the block came from a different Windows feature, such as a message that an app was blocked from running rather than from changing files, it may be Smart App Control; our Smart App Control guide covers that one.

Related guides

• Microsoft Defender Antivirus is turned off notification: false alarm or real?
• Windows Security not opening in Windows 11: how to fix it
• Smart App Control blocked an app: what it means and what to do
• How to scan for malware on Windows 11 and 10 with built-in tools

Official sources

• Microsoft: Virus and threat protection in the Windows Security app
• Microsoft Learn: Protect folders from ransomware with controlled folder access
• Microsoft Learn: Configure controlled folder access
• Microsoft Learn: Monitor controlled folder access activity