Saving files blocked by Controlled access folder (How to fix)

[Graphite Addict]

FIXED Scroll to my second post below, with instructions on how to allow access for each Affinity 2 app

 

I am unable to save files because of Windows security settings. This is because you have created a Windows universal app I presume, which was an indescribably annoying thing to do. It might gain you favour with Microsoft but alienate most experienced Windows using professionals.

What unnecessary hoops do I have to jump through to be able to now save a file?

 

Edit: It is possible to save on other locations that are not protected folders so I can save on a different drive for example. Protected folders are ones such as Documents and Pictures.

While I am at it, let me be probably not the first and not the last to Please request you do a normal installer app and not this Microsoft store packaged type of installer.

Edited November 9, 2022 by Graphite Addict
new information

[walt.farrell]

@Graphite Addict: It sounds like you may have enabled Windows Protected Folder settings. If so, I think you need to specifically allow the applications to save there, and as the V2 applications are new, you would need to add them.

Unfortunately, I do not use those security settings, so I can't make any recommendations. But if you can provide screenshots of the Settings you see, I might be able to make suggestions.

 

[Graphite Addict]

1 hour ago, walt.farrell said:

@Graphite Addict: It sounds like you may have enabled Windows Protected Folder settings. If so, I think you need to specifically allow the applications to save there, and as the V2 applications are new, you would need to add them.

Unfortunately, I do not use those security settings, so I can't make any recommendations. But if you can provide screenshots of the Settings you see, I might be able to make suggestions.

 

I have found the work around. I am currently in the process of writing out all the sets so that it can be added to the FAQ. Persons with protected folders SHOULD NOT be disabling protection. Instead they should be permitting access to the Affinity apps via the method I shall explain.

I will edit this comment and add the information necessary to allow access once I have finished working documenting all the necessary steps.

UPDATE: How to allow access to controlled folders

This explanation is a work in process and is explicitly detailed for beginners. I am working on a quicker method. I will update when I find the quickest way. The same process works for Affinity Designer 2, Affinity Photo 2 and Affinity Publisher 2 (you will just need to run those and follow the same process but select their folders instead)

1. Run Affinity Designer 2
2. Press Ctrl alt del
3. select Task manager
4. on the Processes tab, click the little arrow left of Affinity Designer 2 to expand the program that is running then click Affinity Designer 2 below the larger bit, right click and select open file location
5. In the folder that opens copy folder address from the text box, left click to highlight, right click to copy
it will look something like this C:\Program Files\WindowsApps\SerifEuropeLtd.AffinityDesigner2_2.0.0.1640_x64__3cqzy0nppv2rt\App
Your address may be different.
6. Press the Start menu and type settings, open settings (alternatively click the cogwheel icon for settings)
7. Click Update and Security
8. Click Windows Security, it's on the left column
9. Click Virus & threat protection
10. Scroll down to Virus & threat protection settings and click Manage settings
11. Scroll down to Controlled folder access and click Manage Controlled folder access
12. It will say Ransomware protection, under Controller folder access click Allow an app through controlled folder access
13. A User Access Control warning window pop will ask Do you want to allow this app to make changes to your device? You should see a shield icon Windows Security Verified Publisher: Microsoft Windows, click Yes
14. You will see Allow an app through controlled folder access, click the box + Add an allowed app, from the menu that pops down select Browse all apps
15. In the Open window paste the address of the app you copied 5 e.g. C:\Program Files\WindowsApps\SerifEuropeLtd.AffinityDesigner2_2.0.0.1640_x64__3cqzy0nppv2rt\App and press enter NOTE: your address may be different.
16. Select Designer.exe, it the Blue Designer icon (or just Designer if you don't have file extensions shown) then click Open

Affinity Designer should now be able to save to Controlled access folders.

Edited November 9, 2022 by Graphite Addict
explains process refinement for other apps

[- S -]

As you mentioned, if you've enabled "Controlled Folder Access" in the Windows Security settings, then any applications you want to allow to write or modify locations protected by Controlled Folder Access will need to be manually added to the list of allowed applications.

If an application has not been added to the Controlled Folder Access allow list, then users will see an error when trying to save to a protected folder location saying the following:

File not found.
Check the filename and try again.

This is out of Serif's control.  The reason for the issue is that the paths to Affinity applications have been changed in Version 2.  

What you posted is fine, however whenever you update any of the Affinity applications, you're going to have exactly the same issue again and again, as the software version number (2.0.0.1640 at the moment) is now included in the file paths.

Fortunately, Controlled Folder Access allows the use of wildcards for application paths.  However, unfortunately I don't think the Windows Security user interface will allow using them, as the UI expects the user to navigate to the actual application they want to add to the allow list.

Therefore, in order to use wildcards you would need to use Group Policy or PowerShell to add the allowed application paths.

I've added a PowerShell script below, where the paths use wildcards (*) in place of the version numbers.  This way it shouldn't be necessary to keep adding new Controlled Folder Access rules every single time the applications are updated.  These will then appear in the Windows Security app in the allowed apps section.

To add the rules, run the below in PowerShell (running as Administrator).

$Applications = @(
    "%ProgramFiles%\WindowsApps\SerifEuropeLtd.AffinityPhoto2_*_x64__3cqzy0nppv2rt\App\Photo.exe"
    "%ProgramFiles%\WindowsApps\SerifEuropeLtd.AffinityDesigner2_*_x64__3cqzy0nppv2rt\App\Designer.exe"
    "%ProgramFiles%\WindowsApps\SerifEuropeLtd.AffinityPublisher2_*_x64__3cqzy0nppv2rt\App\Publisher.exe"
)

Add-MpPreference -ControlledFolderAccessAllowedApplications $Applications

To remove the rules again, run the below in PowerShell (running as Administrator).

$Applications = @(
    "%ProgramFiles%\WindowsApps\SerifEuropeLtd.AffinityPhoto2_*_x64__3cqzy0nppv2rt\App\Photo.exe"
    "%ProgramFiles%\WindowsApps\SerifEuropeLtd.AffinityDesigner2_*_x64__3cqzy0nppv2rt\App\Designer.exe"
    "%ProgramFiles%\WindowsApps\SerifEuropeLtd.AffinityPublisher2_*_x64__3cqzy0nppv2rt\App\Publisher.exe"
)

Remove-MpPreference -ControlledFolderAccessAllowedApplications $Applications

 

 

[walt.farrell]

Thanks for those steps.

Do either of you know whether these approaches will work when users have not modified the permissions of the WindowsApp folder? Windows does not want users navigating into that folder, and has taken some extraordinary steps to prevent it.

[- S -]

1 hour ago, walt.farrell said:

Do either of you know whether these approaches will work when users have not modified the permissions of the WindowsApp folder?

I never modify the permissions for the WindowsApps folder, as doing so will likely allow privilege escalation.  So the answer is yes, they will work when users have not modified the permissions of the WindowsApps folder

If a user tries to navigate to C:\Program Files\WindowsApps through Windows File Explorer, then they will see a warning saying "You don't currently have permission to access this folder".

What the OP is doing though is pasting the path to the Affinity folder in the Windows File Explorer address bar, which is launched by the Windows Security app when clicking the "Add an allowed app" button.  I.E. When pasting one of the below in the address bar, it will navigate directly to that folder location without displaying the permissions warning and will allow selecting the required exe to add to the allow list (assuming the app is installed).

C:\Program Files\WindowsApps\SerifEuropeLtd.AffinityPhoto2_2.0.0.1640_x64__3cqzy0nppv2rt\App
C:\Program Files\WindowsApps\SerifEuropeLtd.AffinityDesigner2_2.0.0.1640_x64__3cqzy0nppv2rt\App
C:\Program Files\WindowsApps\SerifEuropeLtd.AffinityPublisher2_2.0.0.1640_x64__3cqzy0nppv2rt\App

Adding allowed applications using PowerShell or Group Policy will also work fine with default folder permissions.

 

[A Quinton]

I just updated to Affinity 1.10 -- and now I am also getting the save error.  File Not Found/Check File Name & Try Again. 

I cannot save/save as, or export to png. 

 

[walt.farrell]

5 hours ago, A Quinton said:

I just updated to Affinity 1.10 -- and now I am also getting the save error.  File Not Found/Check File Name & Try Again. 

I cannot save/save as, or export to png. 

 

Welcome to the Serif Affinity forums.

Have you tried the Power Shell approach suggested above?