Controlled folder access
Primarily a defense against ransomware, controlled folder access (CFA) is another ASR capability. It works by limiting folder write access to allow-listed applications only. If an app isn’t trusted, it can’t modify or delete files in the controlled folders.
Trusted apps are a combination of the ones you specify, and the ones deemed prevalent in Microsoft’s massive telemetry data. Any other apps are forbidden from editing the contents of the folders. Thanks to the vastness of Microsoft’s reputation system, you may not even have to add custom apps. Regardless of the applications you choose to trust, the system will not trust script engines such as PowerShell, even if you add them as exclusions.
The folders are a combination of the ones you specify, and the ones listed by Microsoft by default (public and user profile Documents, Pictures, Videos, Music, and Favorites; including OneDrive redirected versions).
As with ASR rules...
