What does Event 1123 mean?

In the context of Spirion, this is a common cause of "Access Denied" errors during Classification or Remediation (Quarantine/Shred) actions.

Why does this happen to Spirion?

Windows Defender has a feature called Controlled Folder Access (CFA) designed to prevent Ransomware. It only allows "friendly" applications to modify files in protected locations (like Documents, Pictures, or custom network shares).

Because the Spirion Agent (spirion.exe) is not on Microsoft's hardcoded "friendly" list by default, Defender blocks it when it tries to:

1. Write a Classification Tag: (Modifying the file's NTFS attributes).
2. Quarantine a file: (Moving/Deleting the file from a protected folder).
3. Redact/Shred a file: (Overwriting the file content).

How to Read Event 1123

When you find this event in Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational, look for these details:

• Process Name: It will explicitly list C:\Program Files\Spirion\Agent\bin\spirion.exe.
• Path: The specific file or folder that Spirion was blocked from modifying.
• Detection Type: It will usually say "Blocked" or "Audit Mode" (if it's only auditing).

How to Fix Event 1123 Blocks

To allow Spirion to function, you must add the Spirion Agent to the "Allowed Apps" list within Controlled Folder Access.

Option A: Manual Fix (Local Machine)

1. Open Windows Security.
2. Go to Virus & threat protection > Manage ransomware protection.
3. Click Allow an app through Controlled folder access.
4. Click Add an allowed app and browse to C:\Program Files\Spirion\Agent\bin\spirion.exe.

Option B: Enterprise Fix (GPO / Intune)

If you are managing many machines, your IT team needs to add the Spirion executable to the Controlled Folder Access Allowed Applications list via Group Policy or Microsoft Endpoint Manager (Intune).

• GPO Path: Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access > Configure allowed applications

Note: "Audit Mode"

If you see Event 1123 but the Spirion scan succeeded, it means Controlled Folder Access is in Audit Mode. In this mode, Defender logs the event but doesn't actually block the action. However, this is a warning that if your Security team ever switches to "Enforcement Mode," your Spirion remediations will immediately start failing with "Access Denied."

Summary

Event 1123 means Windows Defender's Ransomware Protection blocked Spirion from modifying a file. You must add spirion.exe to the Allowed Apps list in the Defender settings.