Controlled Folder Access

[Igor Kokarev]

Hi,

If the user enables Controlled Folder Access mode in Windows 10/11 to protect certain folders (Documents, Desktop, etc.) or even drives, my application cannot write anything to the protected folders.

As far as I understand, there is no specific API to request permission from the user to write files to a protected folder. However, using the Save As dialog should automatically grant such permission.

As I checked, Lazarus can save project files (*.pas module files) to a protected folder.

My application cannot save files despite the Save As dialog.

- If a new file name is selected, I see an error right on top of the Save As dialog (even before it closes).
- If the file already exists, the dialog closes, but an exception occurs in the file creation code.

Code: Pascal  [Select][+][-]

1. procedure TForm1.Button1Click(Sender: TObject);
2. var
3.   fn          : WideString;
4.   stream      : TFileStream;
5. begin
6.   if SaveDialog1.Execute then begin
7.     fn := SaveDialog1.FileName;
8.     stream := nil;
9.     try
10.       if not FileExists(fn) then stream := TFileStream.Create(fn, fmCreate)
11.       else stream := TFileStream.Create(fn, fmOpenReadWrite or fmShareDenyWrite);
12.       try
13.         stream.WriteAnsiString('test');
14.       except
15.         ShowMessage('Write File Error');
16.       end;
17.     finally
18.       if Assigned(stream) then stream.Free
19.       else ShowMessage('Create Stream Error');
20.     end;
21.   end;
22. end;
23.  

I checked other apps - some apps can write files to the protected folder, some can't (one app was written on Qt/C++). I have no idea what's going on.

[dseligo]

Do you have checked "Use manifest resource" in project options?
Check other options too.
Otherwise make test project which shows problem and post it.

[Igor Kokarev]

Thanks for your reply.
Option "Use manifest resource" is ticked.
I attached a simple test project with one button and Save As dialog. Then try to create/write a file.

[dseligo]

OK, I tried it and experienced same behaviour as you did.
Windows decides which programs can have access (maybe in a similar way as SmartScreen works). You can explicitly add your program by going to Virus & Threat protection, Manage Settings and Manage Controlled folder access. There you can add your program either by clicking on 'Allow an app through controlled folder access' or by going to 'Block history' and enable it from there.

[Igor Kokarev]

Thanks for checking and confirming.
Very interesting situation! I know that the user can manually add us to the "white list", but it is complicated and not intuitive.