Thursday, October 22, 2015

Some findings about file type associations (FTA) in Windows 8.1, 10 and Server 2012 R2

There is a lot of confusion about FTA since Microsoft introduced some changes since Windows 8. There are already very good blog posts on the internet which give some insights and suggestions.

One of those blog post, which in my opinion has done currently the best deep-dive into the inner workings of FTAs is from The AppSence Bigot.

If you are not aware of all the confusion about FTAs I would suggest to read the above mentioned blog post. It gives you a very good introduction to the issues.

This blog post has the intention to add further insights into FTAs and to maybe add an additional piece of the FTAs puzzle.

It is already know that Microsoft introduced since Windows 8 a hash to secure the default handler for a file type. Which means you can no longer use a script or something else to manipulate the registry directly to change the default handler. According to a Mircrosoft Technet blog post, this hash is calculated based on the application and the user. This matches also my findings. And I would like to go a little further and estimate that the hash is calculated base in which place the ProgId of the application has been registered and the user. In the example below the ProgId is FoxitReader.Document.
In contrast to James Rankin (Appsense Bigot), in my environment I am able to roam these settings between different operating systems as long as the application has the registered ProgIds in the same place on each system.
ProgIds can be registered in the following locations, where 1. takes precedence: (example .pdf)

  1. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
  2. HKCU\Software\Classes\.pdf\OpenWithProgIds
  3. HKLM\Software\Classes\.pdf\OpenWithProgIds

I asume, we all know that HKCR is a combined view of HKCU\Software\Classes and HKLM\Software\Classes where HKCU takes precedence.





Some further rules for FTAs regarding registry entries:

  1. If there is a valid Hash and ProgId in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice then this is your default handler.
     
  2. If hash is invalid or does not exist then OpenWithProgIds and OpenWithList keys are compared. OpenWithProgIds has precedence. That means the MRUList value gives you the ordered list of applications. In our example below MRUList is bac, which means:
    first is b = SumatraPDF.exe, second is a = FoxitReader.exe and third is c = AcroRd32.exe.
    That means SumatraPDF is only used as default handler for .pdf if there is actually the correct corresponding ProgId in the OpenWithProgIds Key.

    Please remember that OpenWithProgIds can also exist in HKCU\Classes\Software\.pdf\ and in HKLM\Software\Classes\.pdf\.




     
  3. If 1. and 2. does not match, then the selection for the default handler falls back to ProgId which is found in HKCR\.pdf\(Default). As we know this is a combind view of HKLM\Software\Classes and HKCU\Software\Classes, where HKCU takes precedence.




No comments:

Post a Comment