One built-in Windows setting can stop an unknown encryptor at your Documents folder even when the antivirus has never seen it before. It is off by default. Here is the careful way to turn it on.
Controlled Folder Access (CFA) is the most underused protection in Windows 11. It guards the folders where your life actually lives - Documents, Pictures, Videos, Music, Desktop - and blocks any program that is not trusted from changing files inside them. A photo editor you installed is fine. A random program that arrived yesterday and suddenly wants to rewrite 500 photos is stopped at the folder gate, whatever the antivirus thinks of it. The reason most PCs fail ransomware tests at this layer is simple: the feature ships switched off. This guide turns it on properly, including the two follow-up steps everyone skips.
Windows Security > Virus & threat protectionThat is genuinely all it takes to enable it. Everything after this section is about making it painless, which is where most people give up and switch it back off.
The default protected list covers the standard Windows folders, but most people also keep work in places like D:\Work, a Tally or accounting data folder, or a projects drive. Those are exactly the files ransomware wants.
D:\Work protects everything inside itDo not add whole drives or system folders. Guard the data, not the plumbing.
Sooner or later CFA will block a real program - an older accounting package, a photo tool, a game saving into Documents. Windows shows a notification and the program simply cannot write. This is a prompt to judge, not a disaster:
The discipline that keeps you safe: never allow a program you do not recognise, and never allow something that appeared on its own. Recognised and trusted, or blocked - there is no third option.
Almost all CFA friction happens in the first few days, as your regular programs meet the guard for the first time. After you have allowed the handful of genuine tools you use daily, the prompts normally stop. Give it a week of normal work before deciding it is "annoying" - most users who do this step never hear from it again until the day it quietly blocks something it should.
One honest expectation: freshly installed or rarely used software is the usual source of later prompts. That is the guard doing its job - new programs do not get automatic trust with your documents.
CFA guards files in protected folders against untrusted programs. It does not stop a program you personally allowed, it does not protect folders you never added, and it cannot help if the attack runs with your full permission after you approved every prompt. It is a gate, not a forcefield. Combined with Defender's scanning and an offline backup copy, though, it closes the exact gap - the never-seen-before encryptor - that pure antivirus checking leaves open.
See the test setup and the defences in action on the Technical Anshu channel, then come back and apply the settings on your own PC.
Watch Full VideoIn normal use the effect is not noticeable - it only checks writes to protected folders by programs it does not trust yet. The visible cost is an occasional prompt in the first week, not slower performance.
This is the classic case. Find the program in Protection history, confirm it is your genuine installed software, and add its .exe under Allow an app through Controlled folder access. Its data folder can also be added under Protected folders so both sides of the conversation are covered.
No. CFA blocks untrusted programs, but it cannot protect against disk failure, theft, or a program you mistakenly allowed. One backup copy kept offline is still the layer that saves you on the worst day.