---
title: "What does Event 1123 mean?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/what-does-event-1123-mean"
language: "en"
last_updated: "2026-05-29T02:04:14.032Z"
---

# What does Event 1123 mean?

Event ID 1123 in the Windows Defender Operational log indicates that "Controlled Folder Access" has blocked an application from modifying a file in a protected folder.

In the context of Spirion, this is a common cause of "Access Denied" errors during **Classification** or **Remediation** (Quarantine/Shred) actions.

## Why does this happen to Spirion?

Windows Defender has a feature called **Controlled Folder Access (CFA)** designed to prevent Ransomware. It only allows "friendly" applications to modify files in protected locations (like `Documents`, `Pictures`, or custom network shares).

Because the Spirion Agent (`spirion.exe`) is not on Microsoft's hardcoded "friendly" list by default, Defender blocks it when it tries to:

1.  **Write a Classification Tag:** (Modifying the file's NTFS attributes).
2.  **Quarantine a file:** (Moving/Deleting the file from a protected folder).
3.  **Redact/Shred a file:** (Overwriting the file content).

* * *

## How to Read Event 1123

When you find this event in `Applications and Services Logs > Microsoft > Windows > Windows Defender > Operational`, look for these details:

-   **Process Name:** It will explicitly list `C:\Program Files\Spirion\Agent\bin\spirion.exe`.
-   **Path:** The specific file or folder that Spirion was blocked from modifying.
-   **Detection Type:** It will usually say "Blocked" or "Audit Mode" (if it's only auditing).

* * *

## How to Fix Event 1123 Blocks

To allow Spirion to function, you must add the Spirion Agent to the **"Allowed Apps"** list within Controlled Folder Access.

### Option A: Manual Fix (Local Machine)

1.  Open **Windows Security**.
2.  Go to **Virus & threat protection** > **Manage ransomware protection**.
3.  Click **Allow an app through Controlled folder access**.
4.  Click **Add an allowed app** and browse to `C:\Program Files\Spirion\Agent\bin\spirion.exe`.

### Option B: Enterprise Fix (GPO / Intune)

If you are managing many machines, your IT team needs to add the Spirion executable to the **Controlled Folder Access Allowed Applications** list via Group Policy or Microsoft Endpoint Manager (Intune).

-   **GPO Path:** `Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Controlled Folder Access > Configure allowed applications`

* * *

## Note: "Audit Mode"

If you see Event 1123 but the Spirion scan **succeeded**, it means Controlled Folder Access is in **Audit Mode**. In this mode, Defender logs the event but doesn't actually block the action. However, this is a warning that if your Security team ever switches to "Enforcement Mode," your Spirion remediations will immediately start failing with "Access Denied."

## Summary

Event 1123 means **Windows Defender's Ransomware Protection** blocked Spirion from modifying a file. You must add `spirion.exe` to the **Allowed Apps** list in the Defender settings.