SetUserFTA - Set per-user file type associations in Windows 10

[Arthur]

This looks useful!

 

Website / Download (v1.2)

 

Usage

SetUserFTA.exe extension progid [optional:group]

 

The Story

Recently I had to fight a lot with Windows file type associations. Microsoft changed the way how it works drastically and it is a pain for an administrator to set or to roam FTA’s. If you followed my blog, you noticed that I already have two posts about FTA on Server 2016. Hopefully this one will be the last – because it's the missing piece of the whole puzzle!

 

I will just quote Microsoft on this issue (or feature?):

 

In Pre-Win 8, apps could set the default handler for a file type/protocol by manipulating the registry, this means you could easily have a script or a group policy manipulating the registry. However In Win 8, the registry changes are verified by a hash (unique per user and app) that detects tampering by apps. In the absence of a valid hash, we ignore the default in the registry.

 

Microsoft offers a solution with GPO, but it is Computer-based and not User-based. This means, you can not associate your users on the same server/client with different file types. For example:

 

You have a PDF viewer and a PDF editing software on your XenApp server. Now you want that a certain group opens their PDF’s in the editor and the others only in the viewer (for licensing reasons for example). This is NOT possible anymore and Microsoft states “it is by design” and “this is a security measure”.

 

The hash is secret. Microsoft will not share it with you and obviously doesn't even share it with Citrix – this made me angry and angry me doesn't like a broken system. Because I am into reverse engineering and security, I decided to look for the hash algorithm – and yes, I succeeded.

 

But ever thought about why microsoft is doing this? Is it really about malware hijacking or maybe it is all about “setting our defaults and you must accept them”? Why not simply display a popup where the user has to confirm an FTA change?

 

Details about the hash

I don’t want to disclose too much about the hash, because Microsoft probably will not like that. But I can tell you, that anyone with reverse engineering knowhow can discover it rather quickly. It took me about a day to find it and to get an idea about how it works. To code the SetUserFTA.exe it took me more time – but that is because of the coding language I’ve used.

[Arthur]

New version released.

 

Download: SetUserFTA_v1.3.zip

 

Version 1.3 can now set multiple file type associations based on a config file.

 

SetUserFTA.exe \\mydomain.com\fileshare\ftaconfig.txt

 

This will read all associations from the config file and set them. The file can be on a share or locally. Just add every filetype on a new line like this:

 

.vsdx, VisioViewer.Viewer, Visio Users

 

Values have to be separated by a comma. the group is optional.

 

Using a config file, group names with spaces must not use quotes (but using SetUserFTA per command line they have to).

 

Note: you can supply a domain with the group name like “DOMAIN\Notepad Users” or even in UPN format.

Edited December 1, 2017 by Arthur

[sonofsanta]

Currently on v1.7.1--updating the thread because the links above don't work anymore, guessing only the latest version does. Just trying to reinvent my exam users (with WordPad as the default for RTF files) and hit the logic knot of assocations being per-computer. Just when I think Win10 has run out of ways to make my life arbitrarily more difficult...

 

Thanks for the original post @Arthur--strange how, whenever I google a problem, EduGeek turns up on the first page of results and has the right answer waiting for me in less than sixty seconds

[Disease]

Picking this up again, do you run this exe as part of a login script.

[KK20]

holy necro batman. We use SetUserFTA as microsoft just wont let go of PDFs for us, no matter what GPO I set, how I configure, after updates Microsoft Edge will randomly seize control of PDFs.

 

I have a config file with

 

.acrobatsecuritysettings, AcroExch.acrobatsecuritysettings

.fdf, AcroExch.FDFDoc

.pdf, AcroExch.Document.DC

.pdfxml, AcroExch.pdfxml

.secstore, AcroExch.SecStore

.xdp, AcroExch.XDPDoc

.xfdf, AcroExch.XFDFDoc

and I simply call setuserfta with this config file. Seems to work for us.