Windows Security · The Windows Security App · Lesson 3 of 5

Ransomware Protection

Lock your important folders and plan how you would get files back.

Controlled folder access

Ransomware is malware that scrambles your files so you can't open them. Then it demands money to unscramble them. Scrambling a file this way is called encrypting it. Paying is risky. You may never get the files back, and it pays criminals to try again.

Windows Security has a guard for this. Open Virus & threat protection, then Ransomware protection, also shown as Manage ransomware protection. The main switch is Controlled folder access. It is off unless you turn it on.

Controlled folder access works like a guest list at a door. Some folders are marked protected. Only apps on the list may change files inside them. Any other app is stopped at the door, even if it is already running on your PC.

By default the protected folders include Documents, Pictures, Videos, Music and Favorites. You can add more, like a folder of work files. You can't remove the default ones.

Which apps are on the list? Windows already trusts many well-known apps, such as Microsoft Office. Unknown apps are blocked.

When an app is blocked, a notification appears. It says something like "Unauthorized changes blocked" and names the app. Your files stay as they were.

Sometimes an app you do trust gets blocked, like a small photo editor. You can let it through with Allow an app through Controlled folder access. Ask yourself first: did I install this app on purpose, from its official site? If you don't recognize the name, don't allow it. A blocked unknown app is exactly what this feature is for.

On the practice computer, turn on Controlled folder access and look at the protected folders. Watch an unknown app get blocked from Documents. Allow the photo editor only after checking it is one you trust. Then link OneDrive for file recovery.

Getting files back

Controlled folder access lowers the risk. It doesn't remove it. Ransomware can still reach folders you didn't protect, or slip in through an app you allowed. So you also need a way to get files back.

On the Ransomware protection page there is a second section, Ransomware data recovery. It links to OneDrive, Microsoft's cloud storage. If your files are in OneDrive, it keeps older copies of them.

Two OneDrive tools help after an attack:

• Version history lets you open an earlier copy of a single file, from before it was scrambled.
• Restore your OneDrive rolls back all your OneDrive files to a time in the last 30 days. This one needs a Microsoft 365 subscription. If OneDrive spots a ransomware attack, it alerts you and suggests a date.

Here is a catch. OneDrive syncs, which means changes on your PC copy to the cloud. If your files get scrambled, the scrambled copies sync too. That is why the older versions matter. They let you step back to a time before the damage.

This is also why your own backups still matter, as you learned earlier. A good backup plan for ransomware has these parts:

• At least one copy that is offline, such as an external drive you unplug after each backup. Ransomware can't reach a drive that isn't plugged in.
• Backups that keep older versions, not just the latest copy.
• A test now and then. Try restoring one file to be sure it works.

If ransomware ever strikes, disconnect the PC from the internet and don't plug in your backup drive. Clean the PC first, or have a professional do it. Only then restore your files.