Troubleshooting

Just throwing this here for now so it's all consolidated in one place.

Powershell snippets for troubleshooting:

Check Windows Defender Controlled Folder Access status: (1 = enabled)

Get-MpPreference | Select-Object EnableControlledFolderAccess

EnableControlledFolderAccess
----------------------------
                           0

Check if user's Documents folder is "pinned" in Onedrive: (very rough and ugly, needs work)

$FILE_ATTRIBUTE_PINNED = 0x00080000
$path = "$env:OneDrive\Documents"
$folder = Get-Item $path
$attributes = $folder.Attributes
If (($attributes -band $FILE_ATTRIBUTE_PINNED) -eq 0) {
    Write-Output "not pinned"
} else {
    Write-Output "pinned"
}

pinned

Display a list of recently blocked Windows Defender items:

Get-MpThreatDetection | Select-Object -ExpandProperty resources

file:_C:\WINDOWS\system32\Drivers\RwDrv.sys