How effective is Windows Defender’s ransomware protection on servers?

Controlled Folder Access can be useful, but it has an important limitation on file servers. It evaluates the process performing the write locally, so if a compromised workstation encrypts a share over SMB, the file server may see the writes as coming through the Server service and CFA might not stop them. Also, the default protected folders are usually profile directories, not custom paths such as D:Shares. Add the folders that actually matter and treat CFA as defense in depth, not a complete ransomware strategy.

The product matters less than the operational coverage around it. A SOC or experienced security team can add custom detections, investigate alerts, and perform threat hunting, which makes a major difference. Without monitoring and someone responsible for tuning and responding to detections, Defender is just another security tool that may miss the wider context.

Defender has improved a lot, especially when the server security features and automated investigation capabilities are properly licensed and configured. During a penetration test, it progressively blocked accounts and IPs, applied additional network protections, and terminated sessions as it investigated activity. It may not always react as quickly as some dedicated EDR products, but its current capabilities are strong enough to be a reasonable choice for many organizations.

We’ve used Defender on domain controllers, certificate authorities, file servers, Hyper-V hosts, and SQL servers without significant issues. It even detected a suspicious fake trustedinstaller.exe on one of our Hyper-V systems because the file was in the wrong location and lacked a valid signature. That was a good reminder that the built-in protection can catch real threats when it’s properly configured.

We run Defender across our servers along with Attack Surface Reduction rules and haven’t seen major problems. A few executables were blocked by the ASR rules, but that was manageable. The important part is to test carefully, start in audit mode where possible, and roll changes out gradually rather than enabling everything at once.