Windows 10 Controlled Folder Access Step by Step Guide

Windows 10 Build 16232 and newer builds include a new security feature that can help prevent ransomware, malware, or malicious processes from making changes to files inside folders that you can choose to protect. It is called Windows Defender Controlled Folder Access, and I have been using it for two weeks now, and this article will describe how to set it up, and configure it so that it protects your important files and folders. I strongly recommend anyone using Windows 10 to enable this very helpful feature once they install the Fall Creators Update in a couple of months.

First of all, you are going to have to open up the Windows Defender Security Center, which you can find by going to the tray down at the bottom right of the taskbar and right clicking on the Windows Defender logo and choosing open. You can also click the search icon or the cortana circle and search for defender which will allow you to choose the Windows Defender Security Center. Once you open up the Security Center, you are going to want to find the Virus and Threat protection settings, by clicking the hamburger button on the top left to open up the settings choices and choosing the second item down, which is a shield, (right below the home symbol). This will open up the Antivirus settings, where you will then go to the right down a little and once again click on the Virus and Threat Protection Settings. You need to scroll down until you see Controlled Folder Access.

We are focusing on the Controlled Folder access settings which you can find as you scroll down right after the Automatic Sample Submission On/Off Switch. The first thing you are going to want to do is to change Controlled Folder Access to ON. Next you are going to want to click where it says Protected Folders. This will open Windows Explorer and allow you to choose the folders that you want to be protected. Microsoft has stated that the Windows directory and the libraries are automatically protected, however, just to be sure, I chose Documents, Downloads, my Applications folder, Music, Pictures, and Videos, as well as any external hard drives that are connected to the Windows 10 computer. At first I chose desktop, however I noticed that every time I install an application, the new application is not able to piut shortcuts on the desktop because of the controlled folder access designation, so I eventually removed Desktop from the Protected Folders. The nice thing about this feature is that if an application tries and fails to access a file in a protected folder, you will receive a notification that tells you the location of the executable and where it tries to access. These notifications then stay in the action center, so that if you miss the notification, you will see it later when the Action Center shows up on the right side of the desktop.

For example, I use a program called Internet Download Manager, and it was blocked from accessing the downloads directory. I received a notification that says:
DATA Protection
Unauthorized Changes Blocked C:\Users\james\Downloads\wordpress-com-2-6-0-setup.exe from making changes to the folder C:\Users\james\Desktop

Next step, if the application is safe and you want to allow the application to be able to changed files in the controlled folders, you go down to the next option which says Allow an App through Controlled Folder Access, which brings up Windows Explorer file picker again, where you will find the executable that was blocked and choose it, then accept the UAC prompt. You can go through this as many times as you want, adding any programs that need access to these protected folders.

In summary, Microsoft has finally added a security feature to Windows 10 Fall Creators Update (and any insider preview builds since 16232) that can help prevent ransomware from encryption the files that are inside these controlled folders. The great thing about this feature is that it is brand new, but it works great already, and is configurable enough so that you can whitelist the applications that you need to use to access these folders safely, while any application that Microsoft does not recognize as being safe will be blocked from encrypting any files in these folders. You are not going to want to add every folder, because this will likely cause too many false positives, but you should go through your computer’s hard drives, and move all of your important files into folders that you choose to be Protected Folders. This is a very exciting feature for Security professionals and enterprise I.T., but I am pretty sure that you will need to be running Windows 10 enterprise or Education in order to use this new feature for now.

It is rather simple, and if you are using Windows 10 education or enterprise version I recommend that you immediately turn this on, and set up your controlled folders. I am sure that this feature will be coming to windows server 2016 in the coming insider preview updates, and it is good to see that Microsoft is taking security seriously in Windows 10.

After installing the newest Windows Insider Preview Build 16241, I noticed that when I tried to add new controlled folders or allowed programs with the Windows Defender Security Center, the UI would crash, so I immediately went to PowerShell to check if there were new cmdlets to configure Controlled Folder Access, and there were.

You are now able to use PowerShell to add Controlled Folders, and Applications that are allowed to access and edit files in those folders.

More Bitcoin Faucets Use these links! Make easy money with these secret bitcoin faucets!


2. High Priced Faucet and Games at bitfun

3. Faucetgames and turbo bitcoin faucet at

4. virtualpub


Bonus Android App: CASHO is an android app that has auctions where you can win cash

Here is a link to start and make some money:

Install Casho for Android and make sure to use Referral Code X9R7CZO so we both will earn some instant points to get you started earning cash, once you get some taps, (5 a day are awarded to you),then go to the auctions and try to be the last person to bid before the timer runs out to win the prizes.
To earn 25 taps for winning auctions, you just have to install some apps and run them for 30 seconds, then you can uninstall them, once you get the points.
Once you get 10000 points you can cash out in bitcoin. (It used to be only 1000 points, but since bitcoin transaction prices went up, the minimum cashout had to be increased.)

Some Kodi Builds and add-ons for firestick, kindle fire HD, Windows 10 Kodi app, etc.

Kodi is getting very popular on Amazon Fire Sticks, on Windows PCs, and on Android Tablets and Phones, well I think that the SpinzTV Kodi builds are great for beginners, because they include a lot of the add-ons that one would normally want to install to watch all sorts of content. To get the Kodi SpinzTV Builds do the following:

Add File Source in Kodi,
then Name it… something like spinztv


go to addons
click on the DropBox icon at top left
Choose install from zip file
Now choose the spinz file
Then go to Install from repository, and click on spinz tv
go to program add-ons, and then

click on spinz tv wizard
Install the addon for spinztv wizard
You can now choose a Build:
SpinzTV has some builds for Kodi that are preconfigured depending on the version of Kodi you are running, if you are running the newest version 17.1 look for builds under Krypton with (17.1) before them, if you are running 17.0 then choose a build that has (17.0) before it.

Another addon that is good for movies and tv shows is called ALLUC. you can signup for a free account at
the Alluc addon is in the repository…
Also, you can install Kodi from the Windows Store, and you can also install Kodi on your Amazon Fire HD Tablet, which I have done by simply enabling external application installs.

Implementing Credential Guard using Device Guard Readiness Tool

Credential Guard is a security feature that has been available in Windows 10 since Build 1511.  Enabling it on a Windows 10 laptop requires that the system disk is formatted with GPT.  You must also have secure boot turned on, and you are supposed to have a Trusted Platform Module (TPM 2.0).  I have read in Microsoft’s docs that you can use Credential Guard without a TPM, but then the keys are not secured in the TPM.  Not sure if this is still the case now in the latest Windows Builds, because they do say that a TPM is required.  First you should download the Device Guard and Credential Guard Readiness Kit from Microsoft’s download center.  Next, I will show you the commands you need to run in powershell to use the Readiness Kit.

The Device Guard and Credential Guard Readiness Kit includes a PowerShell script that can be used to check if the device is capable of running credential guard, check if Credential Guard is already running or enabled, and it also does the same for Device Guard and Hyper-V Code Integrity policies.

Make sure you download the new version3.0 of the toolkit. If you may have downloaded the older (version 2.1) script, make sure you go to the link above and re-download the tool.

Okay so you downloaded the tool, next step is to unblock the zip file and unpack the zip file into a directory. Personally, I like to use D:\DistributionShare\DeviceGuardReadinessToolv3.0 . The next thing to do is right click on PowerShell or the PowerShell_ISE and run PowerShell ISE as Administrator. Once you get the ISE opened up you should changed to the directory where you unzipped the Device Guard/Credential Guard Readiness Tool to. Set-Location D:\DistributionShare\DeviceGuardReadinessToolv3
Next we want to run the following script to run the Device Guard Readiness Tool and check if the device is capable of running Credential Guard, Device Guard, or HyperVisor Code Integrity: .\DG_Readiness_Tool_v3.0.ps1 -Capable -DG -CG -HVCI
Now you are going to have to reboot the machine.

After the reboot Open up the PowerShell ISE as Administrator again, and run the script again, or run the script with the switches
-Enable -CG -DG -HVCI, or whichever of the three you want to enable. You can also use the switch -Ready if you have want to see if any of the three security features are already enabled and running.
You should see some immediate feedback in the console, but you are going to want to find the folder C:\DGLOGS and in there will be a log file that will tell you if your computer is capable of enabling Credential Guard, Device Guard, and Hypervisor Code Integrity.


Group Policies to Enable Device Guard and Credential Guard

There are a bunch of group policies that are going to be necessary to enable credential guard and device guard in an Active Directory Domain environment. For the domain controllers, you are going to want to enable the following policies:

DOMAIN CONTROLLERS: AdministrativeTemplates/ComputerConfiguration/System/KDC : The necessary settings include >
KDC support for claims, compound authentication and Kerberos armoring: (This needs to be enabled on all domain controllers in order for Credential Guard to work.)

Also, Request Compound Authentication is necessary for Credential Guard so that as devices authenticate with the Domain Controllers, Kerberos compound authentication is requested. Enable this policy as well.

Next we need to go to the following location in the GPMC.msc (Group Policy Management Console) or GPEDIT.msc ( Group Policy Editor for local policies only):
AdministrativeTemplates/ComputerConfiguration/System/DeviceGuard: Turn on Virtualization Based Security -Enabled, for the options on the bottom, the best choices for testing are:
Select Platform Level: SECURE BOOT
VirtualizationBasesSecurityCodeIntegrity:Enabled without Lock
CredentialGuardConfiguration: Enabled without Lock
Now on a policy that is applied to the domain computers,servers, and devices that are compatible with credential guard, you will enable the following policies:

1. Always send compound authentication first: Enabled
2. Kerberos client support for claims, compound authentication and Kerberos armoring: Enabled
3. Support compound authentication: Enabled – Support authorization with client device information:Automatic

After enabling these policies, you should be on your way to supporting Credential Guard, once you figure out how to use Code Integrity Policies, and enable the policy Deploy Code Integrity Policy (ComputerConfiguration/AdministrativeTemplates/System/DeviceGuard) then you can deploy Device Guard, however this policy is not necessary to use Device Guard. (There are some registry settings that can be set and then you can create code integrity policies and move them to C:\Windows\system32\CodeIntegrity to enable Device Guard.

Microsoft also offers a tool called the Device Guard and Credential Guard Readiness Tool which includes a PowerShell script to help enable Credential Guard, Device Guard, and Hypervisor Code Integrity.