Unauthorized Change Blocked: Should I allow powershell.exe to access folders after enabling Controlled Folder Access?

[Ahmad Gunawan]

I just enabled ‘Controlled Folder Access’ from my Windows Security. Now, at some random times, but mainly after start-up, there are a lot of notifications from Windows Security saying ‘Unauthorized Change Blocked’. In detail, it’s blocking powershell.exe from accessingC:\users\johndoe%userprofile%\AppData\LocalLow\Temp\I scanned powershell.exe from the directory C:\Windows\System32\WindowsPowerShell\v1.0\ using Windows Defender and it didn’t detect any threat. I know powershell.exe is a legitimate Windows program, but I am afraid it’s infected by malware or something and re-tasked for attackin

Continue reading...