Windows Defender SmartScreen or application whitelisting policies are likely blocking the ffmpeg.exe child process spawned by Corz-FFE. Since adding the executable to safe lists failed, you must address the inheritance of execution context and verify that no third-party security software is intercepting the launch command.
Understanding the Execution Context
The core issue lies in how Corz-FFE interacts with Windows security mechanisms. When you run Corz-FFE, it does not just open a file; it executes an external program, specifically ffmpeg.exe, via a system call. Even if you have added both the Corz-FFE executable and the FFmpeg binary to the Windows Defender exclusion list, this action only prevents real-time scanning from quarantining the files themselves. It does not necessarily prevent the operating system from blocking the execution of the binary based on reputation or policy.
SmartScreen operates at two levels: file reputation and app execution. If FFmpeg was downloaded from a less common source or lacks a widespread digital signature, SmartScreen may flag the attempt to run it as potentially unwanted. This is particularly true when the parent application (Corz-FFE) is not a well-known enterprise tool. The block often appears as a silent failure where the GUI opens, but the conversion never starts, or an error dialog appears stating that Windows protected your PC.
This behavior is distinct from simple file corruption. As noted in our guide on Troubleshooting FFmpeg Installation: Access Registry Path Denied, permission issues can also mimic execution blocks, though those usually present with specific access denied errors rather than silent blocking. In this case, the silence or generic protection message points directly to Active Protection features.
Configuring Controlled Folder Access
One of the most common causes for this sudden blocking is Windows Defender’s Controlled Folder Access feature. This feature protects folders like Documents, Pictures, and Desktop from unauthorized changes by applications. If Corz-FFE attempts to write the output file to one of these protected directories, Windows will block the ffmpeg.exe process immediately.
- Open the Windows Security app by searching for it in the Start menu.
- Navigate to Virus & threat protection.
- Scroll down to Ransomware protection and click Manage ransomware protection.
- Check if Controlled folder access is turned On.
- If it is On, click Allow an app through Controlled folder access.
- Select Add an allowed app and choose either Recently blocked apps or Select a blocked app.
- Add both
Corz-FFE.exeandffmpeg.exeto the allowed list.
By explicitly allowing these executables, you bypass the heuristic checks that trigger when an unknown application tries to modify files in sensitive directories. This step is critical because FFmpeg writes new files during transcoding, which Controlled Folder Access interprets as potential ransomware activity.
Disabling Real-Time Protection Temporarily
If Controlled Folder Access is not the culprit, real-time protection might be interfering with the dynamic loading of libraries required by FFmpeg. FFmpeg relies on several DLLs that may not be individually signed or recognized by Windows Defender.
To test this hypothesis, temporarily disable real-time protection. Open Windows Security, go to Virus & threat protection settings, and toggle Real-time protection off. Attempt to run a conversion in Corz-FFE. If the conversion succeeds, the issue is confirmed to be aggressive scanning. You should then re-enable protection and add the entire FFmpeg installation directory to the exclusion list, not just the main executable. This ensures that all dependent libraries are also trusted.
For users managing multiple systems, similar issues arise in corporate environments. If you are on a managed device, see Windows 10 Enterprise: Keyboard Not Detected in Managed Organization with Admin Privileges for insights into how group policies can restrict local application execution, although keyboard detection is unrelated, the principle of policy enforcement is similar.
Checking Third-Party Antivirus Interference
Many users install third-party antivirus software alongside or instead of Windows Defender. Programs like Avast, AVG, or Bitdefender have their own "Shield" or "Behavioral Detection" modules. These modules often operate independently of Windows Defender and can block FFmpeg without warning.
Check your third-party antivirus dashboard for any quarantine logs or active shields. Look for settings related to "Application Control," "Heuristic Analysis," or "Unwanted Application Protection." Disable these specific features temporarily to see if Corz-FFE can launch FFmpeg successfully. If it works, you need to add exclusions within that specific antivirus software, targeting both the Corz-FFE folder and the FFmpeg folder.
Verifying File Integrity and Paths
Ensure that the path to FFmpeg in Corz-FFE settings is correct and contains no special characters or spaces that might confuse the command line interpreter. While rare, incorrect paths can sometimes trigger security warnings if Windows interprets the malformed command as a script injection attempt. Use the full absolute path to ffmpeg.exe in the Corz-FFE configuration dialog to eliminate ambiguity.
Frequently Asked Questions
Why did adding exe files to the safe list not work?
Adding files to the safe list prevents them from being deleted or quarantined, but it does not always grant permission to execute them if they are launched by another process under restricted conditions. SmartScreen and Controlled Folder Access evaluate the action of running the file, not just the file's existence.
Can I use Corz-FFE with portable FFmpeg?
Yes, but you must ensure the portable FFmpeg folder is excluded from Controlled Folder Access and any third-party antivirus shields. Portable versions are often flagged more frequently because they lack installed registry keys that help identify them as legitimate software.
Does disabling SmartScreen affect other apps?
Disabling SmartScreen globally reduces security for all applications, making your system more vulnerable to downloading malicious scripts. It is safer to allow specific apps through SmartScreen or adjust the SmartScreen settings to warn rather than block, rather than turning it off completely.
What if FFmpeg works manually but not through Corz-FFE?
This indicates that the issue is related to the parent-child process relationship. Windows security features may trust the manual launch but block the automated launch initiated by Corz-FFE due to differences in execution context or user privileges.
Should I reinstall FFmpeg?
Reinstalling is rarely necessary unless the binary is corrupted. The issue is almost always environmental, related to Windows security policies or antivirus software interference, rather than the FFmpeg code itself.