Before enabling controlled folder access across a Windows team, run an audit pilot that covers real work. Audit mode records activity without blocking it, helping you find application dependencies before protection interrupts document saves. The useful result is a reviewed list of workflows, protected locations, and justified application exceptions—not simply a quiet notification tray.
Microsoft recommends assessing controlled folder access in audit mode before moving to blocking. This tutorial explains how to plan that assessment for a small office. It is not a malware-testing exercise, and you do not need to download ransomware or disable other protections.
Confirm that the pilot can produce meaningful evidence
Start with one representative, noncritical Windows computer and a named owner. According to Microsoft, controlled folder access requires Microsoft Defender Antivirus to be the primary antivirus, enabled in active mode with real-time protection on. A device running Defender in passive mode is not a valid pilot for this feature.
Ask your endpoint administrator to verify the antivirus state and select audit mode through your approved management method. The Windows Security interface does not offer audit mode, although management tools and PowerShell support it. On a managed computer, do not override central policy with local settings: the change may be reverted or conflict with your security baseline.
Record the original policy and the approved rollback procedure before changing anything. Include device name, owner, pilot start, protected data locations, and where audit events will be reviewed. Keep normal backups working; controlled folder access is not a substitute for recovery copies.
Build a workflow matrix rather than a generic app list
List the actual file operations people depend on. For each workflow, record the application, its executable location, the destination folder, and what successful output looks like. Use harmless sample documents instead of confidential customer records.
- Document editing: open, edit, save, rename, and reopen a sample file.
- Scanning: create a sample PDF using the real scanner software and destination.
- Business application: export a dummy report to the folder staff normally use.
- Background utility: exercise an approved scheduled export or synchronization task.
For example, a scanner might save through a separate helper program rather than its visible user interface. Record the executable identified by the event, not the application name someone remembers. An audit event shows a dependency to investigate, not proof that the program is safe or malicious.
Check actual folder locations too. Redirected folders may be protected at their redirected location, including locations under OneDrive. A successful save outside protected folders tells you little about whether the same workflow will work inside them.
Review events and keep exceptions narrow
Use the event-monitoring method approved for your environment, such as Windows Event Viewer or centrally collected endpoint events. Correlate each event with the time, user, executable path, and sample operation. Audit mode permits activity, so a successful save alone does not establish that blocking mode will allow it.
Microsoft automatically trusts many applications, and the automatically trusted list is not displayed as a normal user-managed allowlist. Do not preemptively allow every installed application. Investigate only genuine workflow conflicts and verify the software publisher, installation source, and expected executable before approving an exception.
Prefer a specific verified executable location over broad wildcard paths. A same-named executable in another directory is not automatically the same trusted application. Avoid allowing general script engines as a convenience: that can permit much broader file-changing behavior than the single business task needs.
After an application is allowed, restart the affected application or service in an approved window before retesting. Microsoft notes that an already running process does not pick up the allowance until it starts again. Do not reboot a production machine reflexively when restarting a specific application is sufficient.
Set an explicit decision gate for blocking
End the pilot only after representative workflows have run, not merely after a fixed number of quiet hours. Include less frequent tasks such as report exports if they fall within the intended deployment. Record unresolved dependencies and assign an owner rather than silently allowing them.
Move a small group to blocking only with approval, user communication, and a recovery route. Repeat the sample operations and check both file results and events. If a legitimate workflow fails, preserve the event details and investigate the narrow exception. If immediate rollback is necessary, restore the recorded policy through the same management channel and document the reduced protection.
Quick questions and completion checklist
Does audit mode protect documents from untrusted changes? No. It records relevant activity without blocking it. Do not describe the pilot as an enforced protection rollout.
Does a quiet pilot guarantee every future app will work? No. Unused workflows, application updates, and new executable locations can introduce later conflicts. Retain an exception-review process.
Before sign-off, confirm active Defender protection, representative workflow coverage, reviewed events, justified exceptions, and an approved rollback owner. For broader preparation, see our cybersecurity home-lab checklist.
Source: Microsoft controlled folder access overview, including prerequisites, audit mode, protected folders, and application allowances.
Safety notice: This tutorial is for educational purposes. Test carefully before production use and follow your organization’s change controls. The site owner is not responsible for misuse, damage, data loss, or production issues.
