Tag Archives: Windows 10

Viewing events for Windows 10 Controlled Folder Access

I wrote about Controlled Folder Access not long ago. Since then, I’ve seen it throw a few dialogs telling me that a particular application was blocked from doing something, but I generally didn’t pay much attention unless I found something that didn’t work. The desktop notification doesn’t show the full path of the blocked executable if it’s anywhere in \program files or \users\appdata. There just isn’t enough room.

Today I saw a message pop up that had some Chinese characters in it– you’d better believe that got my attention. I wanted to see what CFA had blocked. A little digging around led me to an article that explains how to easily create a custom view that shows CFA events. Sure enough, here’s what it showed:

Someone’s up to no good

Since I don’t use Internet Explorer, it’s pretty clear that something is on my machine that shouldn’t be, but, at least for now, CFA has prevented it from doing anything too nefarious. Off to the malware scanner I go!

Advertisements

Leave a comment

Filed under General Tech Stuff, Security

Using Windows GitDesktop with Windows 10 Controlled Folder Access

The Windows 10 Fall Creators Update has a very useful new feature that can dramatically reduce the impact of ransomware: Controlled Folders. You should turn it on (Ed Bott’s article tells you how). Once it’s on, any attempt by an unauthorized program to modify files in controlled folders (including your OneDrive and OneDrive for Business folders and your Documents folder) will fail with an error message like this:

Controlled Folders doing their thing

The problem is, sometimes you want an application to have access to those folders. No problem: you can get there by opening the Windows Defender Security Center app, clicking “Virus and threat protection”, then clicking “Virus and threat protection settings,” and then finally selecting the “Allow an app through Controlled folder access.” It’s an easy enough process.

Unfortunately, you may find that the app you added to the list isn’t the app that actually runs when you try to do something. For example, when you run GitDesktop you’ll see a message like the one above because that app is actually a bundle that includes several binaries. You might think you can just add the binaries themselves, and you should be able to, but instead I got an error saying that the path I had entered wasn’t valid. That’s probably because I (lazily) installed the GitDesktop client on my… desktop… so its binaries are tucked away in my Users directory.

I spent some time scratching my head trying to figure out what to do, then discovered that you could enable Controlled Folder Access with the Set-MpPreference cmdlet. Of course, where there’s a Set- cmdlet, there’s usually a Get- cmdlet, and sure enough…

Get-MpPreference is your friend

A little more digging turned up the Add-MpPreference cmdlet and the associated ControlledFolderAccessAllowedApplications switch. A little digging to figure out which actual copy of git.exe  was being run and I was all set… until I started writing this post and found that SnagIt has the same problem!

Adding a new application

Thus I ended up solving two problems (“why doesn’t GitDesktop work?” and “why won’t SnagIt work?”), learning something new (*-MpPreference), and, at least hopefully, protecting myself and others against ransomware. Onwards!

 

Leave a comment

Filed under General Tech Stuff

My screen went gray: how to turn off Windows 10 color filter mode

I like to think I know my way around Windows after using it daily since Windows 3.1. Sometimes it still surprises me, though.

Today I was working on a blog post for the ENow blog (stay tuned, you’ll see it shortly). I went to copy a quote from a press release and, suddenly, this is what I saw:

Grayscale Windows screen

Where’d my color go?

I couldn’t figure out what the hell had happened, but my screen was suddenly gray. It was at the correct resolution, and everything looked the same except it was gray. At first I thought I’d mistakenly turned on high contrast mode (which you do with left Alt+left Shift+PrtSc) but nope.

A little digging led me to the dialog shown in the image above. Apparently Windows has a “color filter” mode that, when invoked, makes it easier to see certain colors. It’s intended for people with color-vision deficiencies. For ease of use, Microsoft tied it to a key combination: the Windows key + Ctrl + C. I must have accidentally bumped the Windows key while copying my quote.

Now you know.

6 Comments

Filed under General Tech Stuff

Clearing the Windows 10 external monitor cache

I bought a Surface Book on day 1 of its availability, 2 years ago this month. It’s been an excellent machine. I almost never use it with the clipboard undocked so I’m not sure I’d buy another one, but it’s been good.

Recently, though, it has developed a displeasing habit of failing to recognize external monitors. For example, last week when I was at Ignite, I had to borrow Richard’s laptop to do my product demos because mine wouldn’t talk to the monitor we had available. When I got back from Ignite, it was worse– I couldn’t use an external monitor either through the Surface Dock or the built-in DisplayPort. It didn’t matter what monitor or adapter I used, either. The only way I could make an external display light up was to undock the clipboard and plug the dock connector into it.

I tried a large variety of things to fix it, including updating the firmware on the Surface Dock, reverting to an older preview build of Windows, sacrificing a chicken, and loud cursing. Nothing.

Then I posted on Reddit. Within an hour or so, a user posted a link to this thread, and I found the magic solution. I unplugged the dock, deleted HKLM\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity and HKLM\System\CurrentControlSet\Control\GraphicsDrivers\Configuration, plugged the dock  back in, and boom! The external monitor now works normally.

My theory is that a bug in Windows 10 and/or the Surface dGPU driver and/or Windows Insider upgrades caused the problem. I’m not really interested in figuring out the root cause now that I know how to fix it.

Hopefully this will help future generations who may have this same issue…

Leave a comment

Filed under General Tech Stuff