New, unsupported method of preventing user choices: UserChoiceLatest

[User1785604260]

It seems that at some point Microsoft rolled out a new method of preventing user choice: UserChoiceLatest. I found a reference to a blog post about it here: https://kolbi.cz/blog/2025/04/20/userchoicelatest-microsofts-new-protection-for-file-type-associations/

Register-FTA no longer works with this new UserChoiceLatest method.

[farag2]

Hello.
I could bypass thit by this way:

https://github.com/farag2/Sophia-Script-for-Windows/blob/4cffd144a7bc30fdfbe525acfebfb58cd778d699/src/Sophia_Script_for_Windows_11/Module/Sophia.psm1#L8346

https://github.com/farag2/Sophia-Script-for-Windows/blob/4cffd144a7bc30fdfbe525acfebfb58cd778d699/src/Sophia_Script_for_Windows_11/Module/Sophia.psm1#L8698

[User1785604260]

I think that might be a separate issue. I was already disabling UCPD in order to get Register-FTA working. Now there is a whole new "UserChoiceLatest" key that must be used, that I don't see referenced in your changes.

[farag2]

Hm, this is really a new issue. Let me check.

[farag2]

Until it is not GA, I think have time to prepare a new function to calculate hash, but the new method is in development by MS.
What do you think, @Danyfirex?

[emansom]

I have Windows 11 Home 24H2 (OS Build: 26100.4349, Experience Pack: 1000.26100.107.0) and Microsoft enrolled me into this without my knowledge nor consent.

As a result I am no longer able to configure Firefox as my default browser, neither do HTTP and HTTPS link associations show up in Default Apps.

Microsoft got sued over this by their government and the EU. Why are they repeating history? They are certain they'll get away with it this administration, and therefore just do it?

[starfishpatkhoo]

I have Windows 11 Home 24H2 (OS Build: 26100.4349, Experience Pack: 1000.26100.107.0) and Microsoft enrolled me into this without my knowledge nor consent.

I regret to tell you that if you choose to use Windows 11, you agree to a rolling updated OS. The OS is updated every month with Cumulative Updates (CU). Even LTSC is like that, just "slower" updates. This has been true since the beginning of Windows 11 in 2021. If you do not agree to this arrangement, then best stick to Win 10 or in fact, earlier. You cannot stop the updates (and very likely, should not stop).

As a result I am no longer able to configure Firefox as my default browser, neither do HTTP and HTTPS link associations show up in Default Apps.

You can change your default apps. Just go to "Settings" > "Apps" > "Firefox" > "Make Firefox your default browser" ...

We just want a way to change your default apps via command line, programmatically. But Microsoft does not want to allow that, because to be fair, malware/virus/hackers will misuse it to hijack programs for less sophisticated/educated users. Imagine if a malware did it to hijack the default browser setting to "firefoxed.exe" .. Which would run Firefox as child of a hidden parent process, and therefore monitor all keyboard activity and URLs. Is that not a privacy and security nightmare that all users (not just in the US or EU) should be concerned about? So, Microsoft tries to prevent this from happening right from the beginning.

Don't get me wrong, I set up many computers, so a way to configure default apps via CLI is super time-saving and useful to me. But I do also understand Microsoft's point of view.

[Danyfirex]

Until it is not GA, I think have time to prepare a new function to calculate hash, but the new method is in development by MS. What do you think, @Danyfirex?

I'm really sorry, but I'm not interested in trying to repair it or create something new that works. I'm not even sure I could if I wanted to. I originally made this because I needed it at the time and was curious about how it worked. Honestly, it feels like too much effort for something I mostly used on my personal computer. I also don't feel like dealing with Windows 11 and all its changes right now — I'm still using Windows 10.

That said, I really appreciate your interest in the project, and you're more than welcome to modify it or build on it in any way that helps you get it working.

[farag2]

Hello, @Danyfirex, hope're well. Thanks for the feedback. I agree with your position. Windows evolves and sometimes this function will stop working. 🐱

I have Windows 11 Home 24H2 (OS Build: 26100.4349, Experience Pack: 1000.26100.107.0) and Microsoft enrolled me into this without my knowledge nor consent.

I have no the new registry key. The current function version works for me.

[User1785604260]

I've also resigned myself to not fighting Microsoft on this any longer, but figured I'd at least log the issue. I really appreciate the effort on this @Danyfirex , this has worked wonderfully for me for quite awhile. 💖

[emansom]

I regret to tell you that if you choose to use Windows 11, you agree to a rolling updated OS. The OS is updated every month with Cumulative Updates (CU). Even LTSC is like that, just "slower" updates. This has been true since the beginning of Windows 11 in 2021. If you do not agree to this arrangement, then best stick to Win 10 or in fact, earlier. You cannot stop the updates (and very likely, should not stop).

How is this relevant to Microsoft forcing their browser as default? Antitrust laws still exist, their ToS could say whatever and it wouldn't hold up.

You can change your default apps. Just go to "Settings" > "Apps" > "Firefox" > "Make Firefox your default browser" ...

You seem to have read over a sentence in my previous comment: "neither do HTTP and HTTPS link associations show up in Default Apps."
Possibly a screenshot would help you in understanding somewhat?

See how HTTP nor HTTPS doesn't come up no longer?
And no, it's not in any submenu either, I checked all submenus for all browsers installed.

We just want a way to change your default apps via command line, programmatically. But Microsoft does not want to allow that, because to be fair, malware/virus/hackers will misuse it to hijack programs for less sophisticated/educated users. Imagine if a malware did it to hijack the default browser setting to "firefoxed.exe" .. Which would run Firefox as child of a hidden parent process, and therefore monitor all keyboard activity and URLs. Is that not a privacy and security nightmare that all users (not just in the US or EU) should be concerned about? So, Microsoft tries to prevent this from happening right from the beginning.

Yeah, any program can mess with the system. If Microsoft wants to properly solve that, they should look into app sandboxing and how macOS/OSX has been doing that for decades.
Security through obscurity doesn't work, and in this case is just a sad excuse to increase browser marketshare.

Don't get me wrong, I set up many computers, so a way to configure default apps via CLI is super time-saving and useful to me. But I do also understand Microsoft's point of view.

You should start working for them as a lawyer, if you really think that security argument holds up to scrutiny.

[starfishpatkhoo]

I regret to tell you that if you choose to use Windows 11, you agree to a rolling updated OS. The OS is updated every month with Cumulative Updates (CU). Even LTSC is like that, just "slower" updates. This has been true since the beginning of Windows 11 in 2021. If you do not agree to this arrangement, then best stick to Win 10 or in fact, earlier. You cannot stop the updates (and very likely, should not stop).

How is this relevant to Microsoft forcing their browser as default? Antitrust laws still exist, their ToS could say whatever and it wouldn't hold up.

I was just responding to your point about Microsoft forcing updates, for which this UserLatestChoice is implemented as a forced update.

You can change your default apps. Just go to "Settings" > "Apps" > "Firefox" > "Make Firefox your default browser" ...

You seem to have read over a sentence in my previous comment: "neither do HTTP and HTTPS link associations show up in Default Apps." Possibly a screenshot would help you in understanding somewhat?

See how HTTP nor HTTPS doesn't come up no longer? And no, it's not in any submenu either, I checked all submenus for all browsers installed.

And you seem to miss my message also. In that screenshot of yours, scroll down to the app, Firefox, click on it, it goes into the Firefox sub-menu and then you can make the choice for default browser. If you wish to select the handler for HTTP and HTTPS, scroll down all the way to the very bottom, and go to Choose Default by Link Type. If you really do not have those choices, there could be something else not quite right with your Windows installation. Maybe check a clean install in a VM to see if it is also happening there?

You should start working for them as a lawyer, if you really think that security argument holds up to scrutiny.

I was merely trying to shed some light on this matter. I don't like this situation either - if I didn't care for the ability to set the file type associations, I wouldn't even be following this repo. But I think you're taking things a little bit too personally. ^_^

[araghon007]

I decided today to look into how the new hash is generated. I'm not sure how far into detail I can go (I won't name the DLL or the offset to the function unless asked) but I'll share what I found out so far.

The new method seems to be using Machine ID, the timestamp of when ProgId was written, UserSid, file extension and associated Program ID, and a GUID hidden behind a copyright string in the DLL that does the hashing. The last part I'm most worried about since there's multiple strings like that followed by a different GUID so I have no clue how to find the right one if it changes in future versions. The approach I might use in the end is to just call the function directly using an offset, or better, function signature.

[araghon007]

I managed to get a working hash by calling the function with required parameters directly, I'll try to figure out the hashing algorithm later, but I'm still worried about getting the right GUID. Could do that with a fixed offset, but that would once again break with version changes.

[cra3yk]

I managed to get a working hash by calling the function with required parameters directly, I'll try to figure out the hashing algorithm later, but I'm still worried about getting the right GUID.

Any chance for working fork (with UserChoiceLatest) of PS-SFTA script?

[araghon007]

Any chance for working fork (with UserChoiceLatest) of PS-SFTA script?

I took a break for a couple of weeks because I got stumped by what I thought were 2 very complicated hashing functions OpenWith uses, but I got back to it a couple days ago and found out both functions do pretty much the same thing so I started looking into the simpler looking one. Right now, I'm pretty close to having the hashing function figured out, I'm just missing the last few bytes. Once I'm done with that, I'll need to do a lot of cleanup and convert my code to a PowerShell script, as I'm writing it in C#