Is your Windows ransomware protection actually on?

What Controlled Folder Access is

Controlled Folder Access is a Microsoft Defender feature that helps protect files from ransomware by letting trusted apps modify protected folders and blocking untrusted ones. It works at the kernel, which is exactly where a blocker has to sit: it can refuse a write while it is happening. It is Microsoft’s feature, part of Windows, and it is off by default on many machines.

That is the honest division of labour on this page. Windows does the blocking. WinSight tells you whether Windows is doing it. WinSight is not a ransomware blocker and does not become one by reading this setting.

Why “enabled” is not the same as “protecting”

This is the part a settings screen will not tell you. Controlled Folder Access only enforces if Defender itself is actually operating: running in its normal mode, with antivirus and real-time protection enabled. If Defender has stepped aside (passive mode, disabled antivirus, real-time protection off) the toggle can still read “on” while nothing is enforced.

WinSight refuses to report protection it cannot prove. A configured Enabled value with incomplete or contradictory runtime evidence is reported as runtime requirements not met, never as protecting. It is the same rule the outbound firewall follows when it reports Degraded instead of Active.

If you do not use Microsoft Defender

Controlled Folder Access belongs to Defender, so on a machine running Norton, Bitdefender or CrowdStrike the honest answer is not “you are unprotected.” WinSight reads the vendor-neutral Windows Security Center, where every antivirus that wants Windows to stop nagging has to register itself. It reports which products are registered, which report themselves as actively scanning, and whether their definitions are current.

When another antivirus is actively scanning, the Controlled Folder Access line names it and says this is a normal configuration rather than a fault, and then states the limit plainly: WinSight cannot read that product’s own ransomware protection, so you have to confirm it is switched on yourself. On a machine with nothing scanning at all, the wording stays blunt.

The encoding Security Center uses for product state is undocumented by Microsoft, and is treated as such: a byte the reader does not recognise decodes to unknown rather than being rounded to the nearest guess. The product is still listed (“something is registered and its state could not be read” is information you need) but it never counts as protection.

How the check runs

• It is part of the integrity check, alongside driver signing, memory integrity and Secure Boot, so you get the reading during a normal scan, not as a separate errand.
• It reads the Defender WMI provider (the same source as Get-MpPreference) and needs no administrator rights.
• It reports the protected folders, and the list of explicitly allowed applications. If Defender refuses that list to a non-elevated caller, WinSight marks it as requiring elevation rather than showing it as empty: an empty list and an unreadable list are not the same fact.
• When the posture is notable, it links straight to the Windows Security ransomware-protection page so you change the setting where it belongs, in Windows.

What this does not do

• WinSight never turns Controlled Folder Access on or off. It never enables, disables or otherwise configures Defender. The read is read-only and the operator makes the change.
• WinSight does not block ransomware. Its own ransomware feature is opt-in decoy files plus rename/delete-burst and entropy-on-write heuristics: it detects an encryption wave and alerts you, in user mode. Halting a process mid-encryption needs a signed kernel minifilter WinSight does not ship, which is precisely why knowing whether Windows’ blocker is on matters.
• It is not antivirus or EDR, and reading one Defender setting is not a full security audit.
• None of this replaces backups. A blocked write is better than a detected one, and a restored file is better than both.

The two layers together

Used as intended, WinSight covers the gap between them: Windows enforces at the kernel when Controlled Folder Access is genuinely protecting, WinSight tells you when it is not, and WinSight’s own decoys catch an encryption wave that gets past whatever is left. Neither layer is presented as sufficient alone. See the ransomware tool in detail or the FAQ answer.