Folder Locked Via CMD Using Controlled Folder Access On or Off

Folder Locked Via CMD Using Controlled Folder Access Off

 

Folder Locked Via CMD Using Controlled Folder Access On

-------------------------------------------------------------------------------------------------------------

You want to lock or protect a folder via CMD (Command Prompt) using Controlled Folder Access—a Windows security feature that protects important folders from unauthorized changes by apps.

Here’s what you should know:

---

What is Controlled Folder Access?

• It is a feature of Windows Defender Exploit Guard.

• It prevents untrusted apps from changing files in protected folders.

• You can add or remove folders from protection, or allow apps through it.

• Controlled Folder Access can be turned ON or OFF via PowerShell or Windows Security settings.

---

Can you lock a folder directly via CMD with Controlled Folder Access?

• No direct command exists in CMD just to "lock" a folder via Controlled Folder Access.

• You can enable/disable Controlled Folder Access via PowerShell.

• You can add/remove folders or apps to the Controlled Folder Access whitelist.

• Folder locking itself is not the same as Controlled Folder Access.

---

How to manage Controlled Folder Access via command line (PowerShell)?

1. Check Controlled Folder Access status

powershell
Get-MpPreference | Select -ExpandProperty EnableControlledFolderAccess

• Output:

  • 0 = Off

  • 1 = On (Block mode)

  • 2 = Audit mode

---

2. Turn ON Controlled Folder Access

powershell
Set-MpPreference -EnableControlledFolderAccess Enabled

3. Turn OFF Controlled Folder Access

powershell
Set-MpPreference -EnableControlledFolderAccess Disabled

---

4. Add a folder to Controlled Folder Access protection list

Controlled Folder Access protects certain default folders like Documents, Desktop, Pictures, etc., automatically.

• You cannot add arbitrary folders directly to Controlled Folder Access protection, but you can configure protected folders via Group Policy or Registry (advanced).

• Instead, you can allow specific apps to have access to Controlled Folder Access-protected folders.

---

Alternative: Lock Folder via CMD (Basic folder permissions)

If your goal is to restrict access to a folder, a more straightforward way is:

• Use icacls command to modify folder permissions via CMD.

Example: Deny all users access except you

cmd
icacls "C:\Path\To\Folder" /inheritance:r
icacls "C:\Path\To\Folder" /deny Everyone:(F)

• This removes inherited permissions and denies full control to Everyone.

• Be careful: You could lock yourself out.

---

Summary:

Task	Command/Method	Notes
Enable Controlled Folder Access	PowerShell: Set-MpPreference -EnableControlledFolderAccess Enabled	Needs Admin PowerShell
Disable Controlled Folder Access	PowerShell: Set-MpPreference -EnableControlledFolderAccess Disabled
Check status	PowerShell: `Get-MpPreference	Select EnableControlledFolderAccess`
Lock folder via permissions	CMD: icacls	More direct folder lock by permissions
Add folder to Controlled Folder Access	Not directly possible	Controlled Folder Access protects system folders by design