Strange Microsoft Defender behaviour.

Wu Chang 20 Reputation points
2026-09-08T23:48:04.16+00:00

Just today, I restarted my device for the new Windows update. I do not know why, whether it is a new bug or not, but when I open file explorer, Windows Defender gives me a notification saying: "Unauthorized changes blocked". It happened the first time when I opened file explorer for the first time, and now, the same thing happens when file explorer gets opened by an app. For example, I wanted to save a Word document as a pdf and when I opened the "Save as" page, the notification popped up. It is almost constant and I want to know if it is cause of the new update, since it has only happened after I restarted.
It even happened when I opened snipping tool for the screenshot, this time fully blocking the screenshot being saved... screenshot

Windows for home | Windows 11 | Windows update
0 comments
Answer accepted by question author
Ramesh Srinivasan 86,840 Reputation points Independent Advisor
2026-09-09T00:26:27.9666667+00:00

Microsoft Defender's Controlled Folder Access feature shows that notification when an app accesses the user shell folders. This is normal. You may receive a similar notification for RuntimeBroker.exe as well.

Since C:\Windows\System32\SnippingTool.exe is a legitimate Windows file, there is nothing to worry about.

You can add SnippingTool.exe as an exception to the Controlled folder options to prevent the notification.

  1. Open the Windows Security app.
  2. Select the Virus & threat protections
  3. Select Manage ransomware protection.
  4. Under the Controlled folder access section, select Allow an app through Controlled folder access
  5. Select Add an allowed app and add "C:\Windows\System32\SnippingTool.exe" to the exceptions.

Allow an app to access controlled folders - Microsoft Support: https://support.microsoft.com/en-us/windows/allow-an-app-to-access-controlled-folders-b5b6627a-b008-2ca2-7931-7e51e912b034

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.