Blocking Ransomware with Controlled Folder Access
Windows 9 Controlled folder access can stop ransomware from encrypting your documents by making Windows reject changes from programs that have not been trusted with protected folders. It is an access-control barrier, not a promise that every malicious file will be detected.
For a small accounting practice in Melbourne, a design studio in Brisbane or a customs broker in Sydney, the useful question is simple: can an unfamiliar executable reach the files that keep the business running? Controlled Folder Access narrows that path while preserving normal access for approved software.
How the protection works
When the feature is enabled, Windows Defender evaluates attempts to modify protected folders. Applications on the trusted list can continue opening, creating and changing files, while suspicious or unapproved processes receive an access-denied response. The operating system does not need to identify every ransomware strain beforehand because the restriction applies to the process attempting the change.
| Protection method | How access is granted | Ransomware outcome | Main trade-off |
|---|---|---|---|
| Standard user permissions | Signed-in applications often inherit the account’s access rights | Malware may encrypt anything the account can reach | Simple, but trusts every running process |
| Controlled folder access | Only approved applications can change protected folders | Many unauthorised encryption attempts are blocked | Legitimate applications may require an exception |
This protection is most valuable when ransomware arrives through an email attachment, compromised website or remote-access tool rather than through an obvious system-level breach. It also complements antivirus scanning, but it is not a substitute for it. A permitted application that has been compromised, or malware running with elevated administrative rights, may still be able to damage files.
The Windows 9 naming timeline
Microsoft never released a product called Windows 9. Reporting and preview coverage used the name before Microsoft formally introduced Windows 10 in September 2015. Understanding that distinction prevents confusing early Windows 9 speculation with the security controls available in supported releases.
Controlled Folder Access arrived later, in the Windows 10 Fall Creators Update. For readers revisiting the period, the archived Windows 9 desktop preview illustrates the interface ideas being discussed at the time. The visual shell was temporary, however, while the Defender-based folder controls continued evolving in later releases.
Current Windows versions place the option inside Windows Security, so familiarising yourself with the final menu layout is more useful than recreating an early preview. Microsoft also improved the ransomware heuristics surrounding Defender, giving the operating system several ways to recognise and disrupt suspicious encryption behaviour.
Enabling the security layer
Open Windows Security and select Virus & threat protection, followed by Manage settings. Under Controlled folder access, turn the feature on and restore the default protected locations, which normally include Documents, Pictures, Videos, Music and Favorites. Keep Microsoft Defender Antivirus and its security intelligence updated before making changes, because older definitions can misclassify newly released applications.
Anyone evaluating the historical operating-system preview can consult the step-by-step installation guide. Such builds are unsupported and should remain on a disposable test machine. Current Windows releases receive security fixes that early test systems no longer receive, making them unsuitable for business documents or everyday communication.
Expect some applications to be blocked initially. Backup utilities, photo editors, development tools and document converters may require access to a protected folder. Review the activity log, add only the specific applications that need permission and re-test them. Avoid returning the whole folder to an unrestricted state merely to make one program work.
Australian priorities for Windows users
The Australian market includes small businesses that rely on Windows workstations for Microsoft 365, MYOB, Xero, customer records and shared commercial documents. In a Perth office or a busy Melbourne accounting practice, ransomware can interrupt more than email: it can lock staff out of invoices, templates, tax information and files awaiting signatures. Protecting local folders is therefore a practical operational control, not just an individual-PC precaution.
The Australian Cyber Security Centre, part of the Australian Signals Directorate, continues to warn that ransomware often enters organisations through compromised accounts and business email. If encryption exposes personal information, organisations must assess their obligations under the Australian Privacy Act and the Notifiable Data Breaches scheme, including when notification to affected people and the Office of the Australian Information Commissioner is required.
Customs brokers face a particularly sensitive local risk. Encrypted files can include bills of lading, import permits, consignee details and correspondence needed for Australian border clearances. A broker may need to preserve forensic evidence, inform clients and coordinate with Australian Border Force while operational records are inaccessible. Offline copies and tested recovery procedures matter as much as endpoint blocking in that setting.
Extra software should still come from a trustworthy source. A current listing in the Ayoindex software catalogue can assist with identification, but the software publisher’s official download page and digital signature provide stronger assurance than an unfamiliar mirror.
Recovery and realistic limits
The strongest companion to Controlled Folder Access is a tested backup system that follows the 3-2-1 approach: three copies, on two types of storage, with one kept offline or otherwise isolated from the live network. Synchronised folders such as OneDrive can propagate damage when ransomware changes local files, so a synchronised copy should not be treated as a complete backup. Australian businesses should also verify that a restoration actually works rather than assuming a successful backup job guarantees usable documents.
If an incident occurs, isolate the affected computer from the network, stop further sharing and preserve logs before rebuilding or paying any demand. Report significant incidents through the appropriate Australian cyber security and law-enforcement channels, while checking cyber-insurance conditions and contractual notification duties. Businesses holding customs or client records may need specialist legal advice because legal reporting obligations can differ from technical recovery priorities.
Controlled Folder Access can prevent many ransomware payloads from encrypting protected documents, but it cannot make a Windows PC invulnerable. Its value comes from working alongside current security updates, multi-factor authentication, disciplined backups and rehearsed recovery. The combination creates several barriers instead of relying on one setting to recognise every threat.