How to configure file associations for IT Pros
Published Apr 23 2020 11:08 AM 120K Views
Microsoft

All steps described in this have been tested on Windows 10 versions.

These steps apply to Windows 10 release through Windows 11.

Configuring file association prior Windows 10

There were different ways and guidance to set default program prior to Windows 10 (see Managing Default Applications).

Before Windows 10, an application could check default apps, ask for user consent and set default app programmatically using Windows API.

 

1.png

 

 

 

 

 

 

But some programs skip the user consent and set the app defaults into the registry. The main requirement for default file association is often forgotten: the end-user is in control.

Now in Windows 10 checks if registry file extension keys have not been modified to prevent file association hijacking.

File association changes in Windows 10

The way that default file associations work changed in Windows 10.

There is a new UI for the end-user. This new way puts the user in control with a new file association notification.

This notification will be displayed:

2.png

  • On the first launch of a file extension, if multiples programs are registered for handling that file extension.
  • Each time a new application registers a file extension, except if the Always use this app to open .xxx files is checked.

If an application used Windows API to set default apps, the user will receive the following notification:

 

3.png

 

 

 

 

For more information about these changes : https://blogs.windows.com/windowsexperience/2015/05/20/announcing-windows-10-insider-preview-build-1...

You will find some explanation on The Old New Thing blog: Why do my PDF file associations get reset every time I restart?

Windows 10: An app default was reset

But what happens if an application is not using Windows API and writes some stuff and hijacks user preferences?

Now,Windows 10 detects that the registry is corrupted and will reset the default program for this file extension. Additionally, the end-user will receive this notification: An App default was reset. These change is documented in KB4001770: Reset app default when a registry setting is deleted or corrupted and streamlined notification about the corruption.

4.png

How to configure file association in Windows 10?

It's possible for IT Pro to configure or force default association using supported methods.

The best way to do it is to set up a reference computer, install applications, configure default programs and use Dism to export/import the custom default app associations or use a group policy.

  1. Set up a reference computer

  2. Install applications

  3. Go to Control Panel\All Control Panel Items\Default Programs and configure default apps associations. In Windows 10 1709, this control panel item is now in Settings app.

    Let's try to configure Internet Explorer as the default browser

     

     

    5.png

Choose Internet Explorer

6.png

 

 

Internet Explorer is now the default web browser

  1. Export/import the custom default app association with dism.exe
    Note that you need administrator rights to use dism.exe. And to export properly the associations use the same account used in step 3, otherwise you will get a malformed XML file.

  1. Dism.exe /online /export-defaultappassociations:C:\temp\CustomFileAssoc.xml

PS C:\Windows\system32> dism /online /export-defaultappassociations:"C:\Temp\IE-DefaultBrowser.xml"

  1. Open the xml file and check if everything looks good.
     

    7.png

Usually at this step you will be tempted to delete other lines because you simply don't care about them and get a file like this:

8.png

FTA-IE-Only.xml

VERY IMPORTANT: If you want to import your file with DISM.exe, DO NOT delete any file associations entries!
A missing entry will trigger the App default reset notification and you will get a notification storm at the first logon.

9.png

 

 

Refresh your XML on a regular basis

As some recommended applications can manage more extensions with each new Windows 10 version available, it's a good practice to refresh your XML. For example, in Windows 10 1703, Microsoft Edge registers the epub extension. If you're using an XML file from Windows 10 1607, epub is missing. As a result, you will get an app reset notification for epub.

Tips for building your XML file

  • Manually editing the file could result in a non-valid XML file. Ensure that your XML file is valid. Opening XML file in the old Internet Explorer is a good idea to check if the XML is valid. You can try XML Notepad to edit/validate XML files.
  • If you do not see your file extension in XML file, go back to Control Panel\All Control Panel Items\Default Programs and configure default apps associations, select file extension, click on Change Program and confirm the program in the dialog box. Then, export again you're XML file.

Deploy your custom XML

Now it's time to apply your XML file. You have two options:

  • Set up file association in your Windows 10 image. File associations will be configured for new users' profiles. Existing profiles are untouched. Users can change file associations.
  • Configure a policy for your domain-joined computer: file association will be configured at each logon. User will be able to change file association, but at the next logon file association will be configured using XML file. This policy works only for domain-joined computer.

Configure the XML file for your Windows 10 reference image:

Dism.exe /online /import-defaultappassociations:c:\temp\CustomFileAssoc.xml

Your file will be copied in \Windows\System32 with the following name OEMDefaultAssociations.xml

Configure the XML file for your domain-joined computer

Configure the following policy Set a default associations configuration file located in Computer\Policies\Administrative Templates\Windows Components\File Explorer.

If this group policy is enabled and the client machine is domain-joined, the file will be processed, and default associations will be applied at logon time.

10.png

Note: this policy will not prevent user to change the file association. But at each logon the default association configured in XML file will be applied.

How to force only a set of file associations?

Some IT Pros want to force only some file associations and let users in control for others file associations. For example, they want to configure Internet Explorer as default for HTTP/HTTPS only for HR people.

So, they removed everything in the XML file except Internet Explorer entries. As previously seen, removing entries in XML file could result in app reset notifications.

But don't panic, there is a solution to do it in your Windows 10 reference image.

You just need to have two XML files, one for configuring the defaults and another one to force file association.

The main XML, CustomDefaultAssoc.xml must contain all extensions. You need to import this file using:

Dism /online /import-defaultappassociations:C:\CustomDefaultAssoc.xml

The second XML, FTA-IE-Only.xml will contain only a set of file extensions. You need to use this XML file with the group policy Set a default associations configuration file.

11.png

At the first logon, Explorer.exe will apply both XML.

12.png

The end user will have this results without any app reset notifications:

  • PDF files associated with Microsoft Reader.
  • HTM/HTML files associated with Internet Explorer.

13.png

OEMDefaultAssociations.xml contains the following lines:

14.png

IEOnly.xml contains the following lines:

16.png

Why I'm getting an app reset notification?

Raymond Chen talked about this problem. If a program is trying to set some registry keys, Explorer will detect it and the file association will be reset.

Stop using script or other pre-Windows 10 ways for configuring file association.

You can check the Microsoft-Windows-Shell-Core/AppDefaults event log for clues about file associations reset.

17.png

If you want to troubleshoot this, keep calm and run Procmon
;)18.png

 

You should be able to track which application is hijacking your file associations. Once you identified the bad application, the best way to solve this, is to use a more recent version, or contact your vendor.

Why I'm getting the User Choice notification even if I used an XML file?

You could get the following notification starting Windows 10 1703 when you choose an application as the default viewer instead using Microsoft Edge.

19.png20.png

These notification windows are displayed only once if you're clicking on OK. It's because Microsoft Edge is detected as a new application.

If a new app is installed and is registered to an existing file extension or protocol you will get this notification.

If you want to get rid of these notifications, there is a group policy to hide these notifications:

Do not show the 'new application installed' notification

This policy removes the end-user notification for new application associations. These associations are based on file types (e.g. *.txt) or protocols (e.g. http:) If this group policy is enabled, no notifications will be shown

You can find in the table below some group policies related to default file associations settings:

Table 1
Policy Setting Name Policy Path
Do not reinitialize a pre-existing roamed user profile when it is loaded on a machine for the first time Windows Components\File Explorer
Turn off Internet File Association service System\Internet Communication Management\Internet Communication settings
Turn off access to the Store System\Internet Communication Management\Internet Communication settings
Do not show the 'new application installed' notification Windows Components\File Explorer
Set a default associations configuration file Windows Components\File Explorer

Bonus for Adobe Reader XI users

If you are still using Adobe Reader XI, you should get a new application to open PDF, as Adobe Reader XI is out of support.

With Adobe XI installer, you can get an app reset notification for PDF extensions and it will be reset to Microsoft Edge.

You should look at Adobe Reader documentation and launch the Adobe Reader 11 installation with the following command line:

AdbeRdr11010_en_US.exe /rs /sAll /msi EULA_ACCEPT=YES OWNERSHIP_STATE=0

With OWNERSHIP_STATE=0 Adobe Reader stops to change file association for PDF with an unsupported way.

Resources:

8 Comments
Steel Contributor

Thanks for the post - but given even Windows 10 1709 has reached or is reaching end of support, surely we need to know what works on later versions?


All steps described in this blog post have been tested on following Windows 10 versions:

  • Windows 10 1709
  • Windows 10 1703
  • Windows 10 1607
Copper Contributor

Hello,

Is this guide still applicable on windows 10 1909.

Regards,

Mohamad Ghandour

Copper Contributor

@MGhandour @ChrisAtMaf the information still applies to 1903 (and later) releases.

Copper Contributor

Thanks, actuality i did it this way:

Dism.exe /Online /Import-DefaultAppAssociations:C:\AppAssoc.xml

Copper Contributor

hello, any chance you can this via registry?

Copper Contributor

@mpd53210 This would be a little tricky and you will need Windows Pro/Enterprise for these local GPOs to apply and 'stick', but you could try:

  • Create a hidden folder C:\DefaultAssocConfig
  • Create the DefaultAssocConfig.XML with your apps (web search will help you with a seeded XML) and lock it down as read-only for local users (just to be sure) then copy it to the above folder.
  • Create a DefaultFileTypesGPO.reg with the necessary GPO key...
    • Create the local GPO  setting manually for Default File Associations
    • then export the GPO from the registry HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System and keep only DefaultAssocationsConfiguration String with the value of C:\DefaultAssocConfig\DefaultAssocConfig.XML
  • Push out a batch file or command line with -> regedit.exe /s "full path to your DefaultFileTypesGPO.reg file" (suggest you copy the .reg to the local PC, call regedit.exe /s ... and then delete the .reg file)
  • Refresh this reg push weekly or less if it seems to be sticking OK.

 

This might URL be helpful if you want to use PowerShell to set the GPO Registry entry, if you are losing the GPO settings after a few hours -> How to manage Local Group Policy with Powershell (gerane.github.io)

 

(All this is untested....but might be worth a try.)

 

Cheers!

Copper Contributor

Hey there,

has anyone had success with a custom set of file association distributed by GPO with a domain bound machine on this build on Windows:

Name:Microsoft Windows 10 Pro x64
Operating System Version:10.0.19042
Operating System Build Version:

19042


I'm able to export the current associations with the DISM tool, however, when I set the GPO to apply in the Local Group Policy for my test machine, it isn't respected.  I am following advice to place this .xml file in a folder that isn't the root C:\ directory, but its own specific one, and it is read only for all users.

Another interesting thing I observed: I was only able to export the current associations on my test machine with a local administrator account and not with a domain admin account.

Cinesync Player Beta is the application I'm attempting to set associations for.

Copper Contributor

I apologize in advance if this sounds a little condescending, but I couldn't leave it alone.  As a user AND programmer in both Windows, Linux, and BSD, I came back needing to develop upon Windows 10 recently.  Every time this happens, the API and procedures for doing some of the most simplex tasks take far more steps than they did.  This business with File Extensions is a good example of that.  Now far more steps need be taken to do the same thing. It seems security is a such a problem that writing in these odd fixes here and there is now a well-used solution.  The separation of security frameworks and other parts of the system are harder to see, more and more. The security fixes being seemingly there solely to plug holes(tm).  Woven together like this may seem like a great way to reinforce the fabric in the foundation; but also suffocates in return.

   My problem is that it feels like defending malicious intent takes the front seat in Windows, and assumptions are made as to the common user's being devoid of common sense.  Substituting common sense for patches all over the place to combat attack.  Every time something is "rewritten", usually in some collection of libraries, it is only partially done so, and usually with some sort of retrofit for older applications as so to be backward compatible. But in more cases than not, end up breaking them entirely.  

  I'm sure it's with the best intentions, but I feel like the wheel has been reinvented about a million times here, with the endgame being secure to the point that every user is assumed to be at a 5-year-old intellect, and needs not worry about breaking anything, nor be held accountable for any attack at any time.  

Co-Authors
Version history
Last update:
‎Feb 15 2023 11:02 AM
Updated by: