Windows 10: New sneaky Windows driver UCDP stops non-Microsoft software from setting defaults

Microsoft has integrated the driver userChoice Protection Driver, short UCPD, into Windows 10 and Windows 11 systems recently. This driver has just one purpose: to block access to UserChoice Registry keys.

These Registry keys define the default programs on the system. There are keys for the default web browser, PDF Viewer, or image editor. Keys exist for file extensions and protocols as well.

Microsoft introduced a new convoluted way of changing default apps and file extension associations in Windows 11 for users. You can check out our guide on setting default apps on Windows 11 here.

Up until recently, programs could make changes to the UserChoice Registry keys to change default parameters. A web browser could set itself as the default program for all supported file types. Provided that the user wanted this, it make things a lot easier thanks to the automated way of changing defaults.

Specialized programs, such as SetUserFTA or Sophia Script, included the functionality as well. They made it easier for home users and administrators to change defaults on Windows machines.

Find out if UCPD is installed




You are probably wondering if the filter driver is installed and running on your Windows system. Here is how you can determine that:

• Open Start, type cmd and select Command Prompt from the results.
• Type sc query UCDP.

How UCDP works


Gunnar Haslinger published an analysis on his blog. The filter driver blocks access to certain UserChoice Registry keys by returning access denied.

Microsoft still allows access, but only for processes that pass the following verification:

1. Is the process signed by Microsoft?
2. Is the process on the deny list?

In other words: any third-party program that tries to make changes to default apps, file extension handline or protocols on Windows is blocked from doing so.

The deny list includes Windows tools, likely to prevent third-party developers from using them as a workaround. Tools like regedit.exe, reg.exe, or powershell.exe are on the deny list.

Can you stop UCDP?


It takes two steps to put an end to UCDP.

1. Set the startup type of UserChoice Protection Driver to disabled.
2. Deactivate the UCDP Velocity task in the Task Scheduler.

Step 1: Change the startup type of UCDP to disabled



It is necessary to block the filter driver from starting with Windows. Here is how that is done:

1. Open Start, type cmd, and select run as administrator.
2. Execute the following command: sc config UCPD start= disabled

Step 2: Deactivate UCDP Velocity in the Task Scheduler



The UCDP Velocity task has a single purpose: make sure that the filter driver runs. It does so after each user sign. If its validation fails, it will reset the startup type of the UCD service to system start to make sure that it starts with the system. It will furthermore start the service to make sure the filter runs on the device.

While starting is possible at any time, disabling is not. Disabling works only if the startup type is set to disabled and the system is restarted.

The task checks the value of FeatureV2 in HKLM\SYSTEM\CurrentControlSet\Services\UCPD as well. If not set to the value 2, it will set the value to it.

Here is how you disable the task:

1. Open Start.
2. Type Task Scheduler.
3. Select "Run as administrator" from the list of options.
4. Use the sidebar to go to Task Scheduler Library > Microsoft > AppxDeploymentClient.
5. Right-click on the task and select "disable".

You may also run this from an elevated command prompt: schtasks.exe /change /Disable /TN "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity"

A restart of the system is required to complete the process.

Closing Words


Microsoft did not announced the new filter driver on any of its sites or blogs to the best of my knowledge. It is therefore unclear why it was introduced.

When you look at the filters functionality, you will notice that it blocks third-party programs from making changes to the defaults. Microsoft's filter makes no distinction here; legitimate programs such as web browsers are blocked, even if the user wants the changes to the defaults to be made.

Similarly, specialized programs, such as the aforementioned SetUserFTA are also blocked. These are usually run by users and administrators to make "wanted" changes to the system.

Clearly, Microsoft is reducing user choice and abilities with the new filter driver. Even if it is designed to protect against certain types of malicious software, it has the side effect of removing options from users. It is also clear that Microsoft is the benefactor here, as it is now more difficult to change defaults on Windows machines.

There will be workarounds and likely a cat and mouse game between Microsoft adding workarounds to the deny list and developers finding new ways to make the changes.

We asked Microsoft for comment on the matter, but have not heard back yet.

Thank you for being a Ghacks reader. The post New sneaky Windows driver UCDP stops non-Microsoft software from setting defaults appeared first on gHacks Technology News.

read more...

 

New Wifi default to metered

Chris,

Yes, it is a Registry entry. See the procedure in my post #74 in another TenForums thread. {in case it is of interest, my post #73 in that thread lists the steps I take to avoid all automatic Windows updates}

By making that change, every new WiFi network will, by default, be set as metered. You will still be able to change that back to non-metered for a specific WiFi network in the normal manner.

Denis

 

Microsoft establishes 12 principles for Windows development

Microsoft has announced 12 principles that it will use to guide the development of it's Windows platform. Brad Smith, Microsoft's Senior Vice President, outlined these principles based on the experiences of the company, such as antitrust battles, regulatory scrutiny, and fierce competition in the software market. The 12 principles are based on three main areas: Choice for computer manufacturers and customers, opportunities for developers, and interoperability for users. The principles are-

When asked about the new policies, Brad Smith says "We've had nearly five years of experience under the U.S. consent decree, and the one thing we've learned the importance of is humility…".

Source: Eweek

 

Microsoft signals end of Paint program

Microsoft has confirmed that it will continue to offer its graphics program Paint.

In a recent update, it had listed Paint as a feature that would be either removed or no longer developed.

Paint, renowned for its simplicity, has been part of the Windows operating system since its launch in 1985.

Microsoft suggested it would not remain on Windows 10 by default but did say it would be available for free on the Windows Store.

BBC news Report here
Microsoft Paint avoids brush with death