Explorer.exe Blocked by Windows Defender or Firewall?

When you see the “Protected folder access blocked” message from Windows Defender, it usually means that Controlled Folder Access (CFA) has detected an app or a process attempting to modify or access files in protected directories, like your OneDrive or Pictures folder. In this case, the blocked process is explorer.exe, which might seem odd because it’s a Windows process. This guide will explain why the block happens, whether it’s really a malware attack, and how to allow the process to access protected folders (only if it’s legit).

Also see: Restart Explorer.exe with CMD or PowerShell in Windows 11

Why did Windows Defender block explorer.exe?

Microsoft Defender’s “Controlled Folder Access” is a security feature made to protect sensitive folders by restricting access to only trusted applications and processes.

If an app tries to access or modify files in a protected folder without explicit permission, it will be blocked. The error message you’ve seen might look like this:

Protected folder access blocked
Low
9/5/2024 12:09 AM

Your administrator has blocked this action.

App or process blocked: explorer.exe
Protected folder: %userprofile%\OneDrive\Pictures

Blocked by: Controlled folder access

You can allow apps to access your protected folders, but you should only allow apps that you trust.

This message basically tells you that explorer.exe, which is your file manager in Windows, was blocked from accessing a protected folder like your OneDrive Pictures folder. Controlled Folder Access is working as intended, but in this case, it may have mistakenly flagged explorer.exe.

However, despite all its merits, “Controlled Folder Access” isn’t actually enabled by default (in most cases) on Windows 11 or Windows 10. It’s a ransomware protection that is meant to be an optional security feature. If you’re suddenly seeing many “Protected folder access blocked” errors, it means that you have recently enabled the CFA feature, and it’s just doing its job.

Pro tip: How to Reinstall Windows Defender in Windows 11

Why does this happen?

Well, the block usually occurs for two reasons:

1. The explorer.exe that has been blocked is the legit process, but Controlled Folder Access flags it because of a permissions conflict or an attempt to access a folder that it thinks is sensitive. Explorer.exe is also the process for File Explorer, but sometimes it tries to access folders that Windows Defender may be overly cautious about.
2. In some rare cases, it could be a fake or malicious explorer.exe that tries to access your protected folders. This is a much more serious scenario and should be attended to carefully, like doing a full system scan immediately.

Might be useful: How to Refresh File Explorer in Windows 11

Is the flagged explorer.exe really genuine?

Before allowing explorer.exe access to any protected folders, it’s very important to verify that the process is indeed legit and not any kind of malware in disguise.

You can check the file location of the explorer.exe process. Open Task Manager (Ctrl + Shift + Esc) and search for “explorer.exe” in the Processes or Details tab. Right-click the explorer.exe process and select “Open file location“. If there is more than one instance of explorer.exe, check each of their locations.

The legitimate explorer.exe should be in C:\Windows\. If it’s anywhere else, it’s a red flag that this process could be malware.

To be on the safe side, even if the file location seems correct, run a full system scan using Windows Defender or another trusted antivirus software. This makes sure that no malware has compromised your system.

How to allow explorer.exe to access protected folders

If you’ve double-checked that the explorer.exe on your system is genuine and want to stop the error so that it can access your protected folders, follow the steps below to allow it through Controlled Folder Access (applicable to any process or app as well):

1. Click on the Start menu, type “Windows Security” and open the app.
2. Once inside Windows Security, click “Virus & threat protection” from the left-hand menu.
3. Scroll down until you see “Ransomware protection“. Click “Manage ransomware protection“.
4. Under Controlled Folder Access, click “Allow an app through Controlled Folder Access“.
5. Click “Add an allowed app” and then select “Recently blocked apps“. Here, you should find explorer.exe listed. Click on it to allow access.
6. After adding explorer.exe, try accessing the folder again to see if the issue is fixed.

Only allow explorer.exe to access protected folders if you’ve confirmed that your explorer.exe file (or any other process or app that you’re whitelisting) is safe.

Related guide: How to Allow an App Through Firewall in Windows 11

Disable Controlled Folder Access temporarily (not recommended)

If nothing else works and you need the app or process to access your folders immediately, you can disable Controlled Folder Access temporarily:

• Go to “Windows Security“, and select “Virus & Threat Protection“.
• Click “Manage ransomware protection“.
• Toggle off “Controlled Folder Access“.

Important: Disabling CFA will leave your files vulnerable to ransomware attacks, so only use this as a last resort, and remember to turn it back on after you’ve dealt with your problem.