Microsoft has implemented a new security measure through a Windows driver, aimed at preventing unauthorized changes to the default browser settings in Windows 10 and Windows 11. The driver, part of the February updates (KB5034763 for Windows 10 and KB5034765 for Windows 11), restricts users from manually changing the default browser or doing so through third-party software. IT consultant Christoph Kolbicz discovered this change when his tools, designed for adjusting default program settings, ceased functioning.
Technical Insights and User Impacts
The driver, known as the User Choice Protection Driver (UCPD.sys), specifically targets the Registry keys associated with HTTP, HTTPS URL associations, and the .PDF file association. These keys are crucial for setting default programs for web browsing and viewing PDF files. Previously, users could manipulate these settings through the Registry or third-party tools. However, with the introduction of UCPD.sys, any attempt to modify these settings outside the designated Windows interface results in an error. Despite this, Kolbicz outlines a method to disable the driver via the Registry, though this action requires administrative rights and a system reboot. Additionally, a scheduled task named ‘UCPD velocity' may reactivate the service if disabled, necessitating the deletion or disabling of this task for a permanent solution.
I got multiple reports that #SetUserFTA and #SetDefaultBrowser http/s associations stopped working after the newest Windows 10 updates. Cannot reproduce it myself yet, but i know what causes the issue. I always expected Microsoft to do that move. Im working on it – stay tuned.
— Christoph Kolbicz (@_kolbicz) February 23, 2024
Regulatory Compliance and Future Implications
The introduction of the User Choice Protection Driver might be in response to regulatory requirements, such as the Digital Markets Act (DMA) in Europe, which mandates fair competition and prevents anti-competitive practices by major tech companies. Microsoft announced changes to comply with the DMA, including policies to respect users' default browser choices in the European Economic Area (EEA). However, the deployment of this driver in regions outside the EEA, such as the USA, raises questions about its intended purpose. Microsoft has yet to provide detailed comments on the matter, leaving room for speculation about the broader implications of this security measure on user autonomy and software interoperability in Windows operating systems.
