Only attempts to write to protected disk sectors will be recorded in the Windows event log (under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124).Īttempts to modify or delete files in protected folders will not be recorded.With the Fall 2017 update to Windows 10 (version 1709 or newer), Microsoft added a terrific new feature to the operating system that should prove to be very effective in preventing ransomware from attacking your computer and holding your data hostage. The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. The Windows event log will record these attempts under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1124. These attempts will not be recorded in the Windows event log. The following will not be blocked and will be allowed to run: The Windows event log will record these blocks under Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational > ID 1123. Attempts by untrusted apps to write to disk sectors Attempts by untrusted apps to modify or delete files in protected folders You can add additional trusted applications in the Configure allowed applications GP setting.ĭefault system folders are automatically protected, but you can add folders in the Configure protected folders GP setting.

Microsoft Defender Antivirus automatically determines which applications can be trusted. You can also choose to only block or audit writes to disk sectors while still allowing the modification or deletion of files in protected folders.

Modify or delete files in protected folders, such as the Documents folder You can choose to block, audit, or allow attempts by untrusted apps to: Enable or disable controlled folder access for untrusted applications.

Controlled folder access