How to enable or disable UserChoice Protection Driver (UCPD) in Windows

If you use Windows 10 or 11 and have noticed that it's almost impossible to configure a browser, PDF reader, or even your device's region "the way you want," the culprit is probably the UserChoice Protection Driver (UCPD)This component, which operates at a very low level in the system, has crept into virtually all modern Windows installations and, although well-intentioned, can be a real headache for administrators, advanced users, and customization tools.

In the following lines you will find a clear explanation of exactly what UCPD is, what it protects, why Microsoft introduced it, and how you can deactivate it or reactivate it safely This guide covers both changing the device region (DeviceRegion) and allowing scripts and programs to adjust default applications. It includes detailed steps, security warnings, and example commands in both PowerShell and the classic command line.

What is the UserChoice Protection Driver (UCPD) and what does it protect?

UCPD is a file system filter driver (a mini-filter) introduced by Microsoft in recent versions of Windows 10 and Windows 11, deployed on a massive scale between early and spring 2024. Its main mission is to prevent unauthorized processes, especially third-party tools, from modifying certain registry values ​​related to default applications and with the device region.

This controller is responsible, among other things, for blocking write or delete access to various UserChoice keys from the RegistryThese keys determine, for example, which program opens http and https URLs, which browser is the default, or which application handles PDF files. When a process that doesn't meet the filter criteria tries to write to those paths, the result is an error. "ACCESS DENIED"even though the user apparently has sufficient permissions.

Internally, UCPD is loaded as a driver of type FILE_SYSTEM_DRIVER in the activity filter group (FSFilter Activity Monitor). You can view it with commands like sc qc ucpd o fltMC filterswhere it appears alongside other filters such as WdFilter (Defender), bindflt, and FileInfo. Being at a certain "altitude" within the filter stack, it can intercept and decide whether or not to allow operations on the file system and the Registry.

Furthermore, UCPD doesn't just protect file and protocol associations. In recent versions, it has also been extended to other sensitive scenarios, such as the value DeviceRegionwhich determines which country the device is located in, something that intersects with functions such as the ability to uninstall Microsoft Edge in certain EU countries.

How does UCPD decide which processes to block?

The inner workings of UCPD are more sophisticated than they might seem. Instead of blocking indiscriminately, the driver evaluates whether the process attempting to write to the protected keys is a binary signed by Microsoft and, furthermore, whether or not it is included on a deny list. Only processes that pass both filters can modify those parts of the Registry.

On one hand, UCPD checks the digital signature of the executable and ensures that it belongs to Microsoft and is recognized as an official part of the system. On the other hand, it maintains a internal list of banned processes Even though they are from Microsoft, they cannot be used as a "tool" to bypass the protection. In other words, it's not enough for a binary to be official: if it's on the deny list, it will still be blocked.

Windows processes typically included in this deny list include executables commonly used to manage the system or automate changes, such as cmd.exe, powershell.exe, reg.exe, regedit.exe, rundll32.exe, dllhost.exe, wscript.exe or cscript.exeamong others. The idea is to prevent third-party tools from "relying" on these binaries to write to the UserChoice or DeviceRegion keys.

In practice, this means that even legitimate programs that previously worked without problems—such as SetUserFTASophia Script, VMWare solutions, or enterprise deployment tools—may encounter access denied errors when attempting to set browsers, PDF readers, or other default applications.

Microsoft has been adjusting UCPD's behavior over time, expanding the list of blocked processes and closing some shortcuts that the community had discovered to circumvent the restrictions. Recent versions of the driver (ucpd.sys) have increasingly tightened the policy, forcing the search for more sophisticated solutions or official procedures.

Registration keys under UCPD protection

One of the key questions for administrators and advanced users is which exact Registry paths are behind the UCPD "wall." Through practical analysis, driver disassembly, and testing with tools like Process Monitor, it has been determined that the driver blocks delete and write operations in several critical keys.

Among the most relevant paths protected by UCPD are those associated with URLs and PDFs in the user profile, usually under HKCU\Software\Microsoft\Windows\Shell\Associations y HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExtsFor example, keywords such as:

• Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice
• Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoiceLatest
• Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoicePrevious
• Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoice
• Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoiceLatest
• Software\Microsoft\Windows\Shell\Associations\UrlAssociations\https\UserChoicePrevious
• Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice
• Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoiceLatest
• Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoicePrevious

Furthermore, it has been proven to also protect the key of device region in HKLM, specifically:

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\DeviceRegion\DeviceRegion

This last point is very relevant, because certain features of Windows—such as the possibility of uninstalling Microsoft Edge— they depend on whether the DeviceRegion value corresponds to a country in the European Union. For example, a region code indicating Austria or Germany will allow uninstallation, while a value representing the United States will block it. And that same value is now protected by UCPD against automatic changes.

UCPD components: scheduled service and task

To understand how to activate or deactivate UCPD without it turning itself back on, you need to know its two main components: the UCPD service/driver and the scheduled task "UCPD velocity", hosted in the Windows Task Scheduler. Both work together to ensure that protection is always active.

On one hand, there is the system service simply called "UCPD", which loads the driver system32\drivers\UCPD.sysIn many recent installations, your startup type is set to SYSTEM_START (1)This means that the driver is loaded very early during startup, before the user logs in.

On the other hand, there is a scheduled task under the route \Microsoft\Windows\AppxDeploymentClient\UCPD velocityThis task is normally executed after the user logs in and after a certain period of inactivity, and it calls UCPDMgr.exe, a Microsoft utility responsible for reviewing and "repairing" the state of the UCPD service if it detects unwanted changes.

The behavior of this task is quite clear: it checks if the The service configuration matches what was expected. (starting as SYSTEM_START, internal feature value "FeatureV2" set to 2, service running, etc.) and, if not, restores the recommended configuration. This means that even if you change the service's startup type, at the next login the task might revert to its previous state unless you also disable it.

Important: This Task Scheduler task is only visible and editable with administrator permissionA standard user will not see it listed, which may give the impression that the system "self-corrects" without any explanation.

Check if UCPD is active on your system

Before disabling anything, it's a good idea to check if UCPD is actually running on your computer. On most modern machines with updated Windows 10 or 11, the answer will be yes, but it's worth confirming with a couple of simple commands.

From Windows Terminal or PowerShell, you can run:

• Get-Service UCPD

The result will show you if the service is in state Running (in progress) or Stopped (stopped), as well as the configured startup type. If you prefer the classic command line (CMD), you can use:

• sc query ucpd

In this case, you'll see detailed information about the service: type, status, exit code, and whether it's configured to start with the system. If it appears as STATE: 4 RUNNING y START_TYPE: 1 SYSTEM_STARTThis means that the driver is fully operational and is loaded on every boot.

In corporate environments where migration tools or bulk scripts are used, symptoms of an active UCPD may appear in the error logs as exceptions of type System.UnauthorizedAccessException, indicating that an unauthorized operation has been attempted on keys such as HKEY_USERS\<SID>\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\<protocolo>\UserChoice.

Temporarily disable UCPD to modify the region or default apps

There are specific cases where it may be necessary temporarily disable UCPDFor example, to correctly adjust the device region when Windows has set it incorrectly during installation, to allow a corporate script to configure default applications, or to troubleshoot profile migration issues.

The key is to do it carefully: Disable the UCPD service and the "UCPD velocity" taskMake the necessary changes (for example, modify DeviceRegion or delete/recreate association keys), and then reactivate the protection to avoid leaving the system exposed to unwanted changes by third-party software.

A common approach involves directly modifying the Registry values ​​associated with the UCPD service from PowerShell with elevated privileges. For example, to prevent the driver from loading, the value is changed. Start The service is set to 4 (Disabled), and the Task Scheduler task that would reconfigure it is deactivated.

In managed migration scenarios, these steps are even encapsulated in pre and post migration scripts (for example, UCPDStartup.ps1 and UCPDComplete.ps1) which are launched before and after the process, ensuring that the migration agent can touch the necessary keys and then leave everything as it was.

It's important to keep in mind that the UCPD driver is loaded into memory during startup. Therefore, after changing the service startup type or disabling the automatic wake-up task, it will be essential to... reboot the system so that the changes really take effect and the driver stops intercepting operations.

Detailed steps to disable UCPD from PowerShell

If you want to get straight to the point and disable the UserChoice Protection Driver, both to adjust the device region and to prevent third-party tools from modifying default associations, you can follow a script in PowerShell. Everything must be run in a console with Administrator privileges.

First, you need to prevent the service from loading with the system. To do this, change the value Start from UCPD service to 4 (Disabled) using:

• Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\UCPD" -Name "Start" -Value 4

With this setting, the driver will not start on the next boot. However, if you do nothing else, the scheduled task "UCPD velocity" could reactivate and reconfigure the service on the next login, so the next step is Disable that task:

• Disable-ScheduledTask -TaskName "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity" -ErrorAction SilentlyContinue

This command disables the task responsible for monitoring the service's status and forcing its start/configuration if it detects unwanted changes. The parameter -ErrorAction SilentlyContinue It simply hides messages if the task does not exist or is already disabled.

Once these two commands have been executed, it is essential Restart the systemThis restart is mandatory because the UCPD driver is already loaded into RAM, and only by shutting down and restarting Windows can you ensure that the system boots without that active protection.

After the restart, UCPD will no longer be intercepting access, so you will be able to modify protected keys (DeviceRegion, UserChoice, etc.) using the usual tools (PowerShell, regedit, corporate scripts, etc.), always taking care to know exactly what you are touching.

Change the device region (DeviceRegion) without UCPD blocking

One of the most striking cases where UCPD interferes is in the device regionIn Settings > Time & Language > Language & Region, at the bottom of the page, you'll find "Device settings region." This value is usually set during Windows installation, and on some computers, it may display an incorrect country or even "Unknown."

When that region is faulty, functions such as the Mobile integration into the Home menuThis includes certain regional characteristics or even the behavior of the Edge browser itself regarding its uninstallation in EU territories. The problem is that UCPD protects the Registry value where this configuration is stored, preventing automated changes.

After temporarily disabling UCPD (service and task, with a restart in between), you can open it again. PowerShell as administrator and directly write the correct country code into the key DeviceRegionThe value is in DWORD format and represents a numeric country identifier.

The general command to set the device region would be:

• Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\DeviceRegion" -Name "DeviceRegion" -Value <codigoPais> -Type DWord

You just need to replace by the number corresponding to your country. Some examples of known codes are:

• Australia: 12
• Brazil: 32
• to Canada: 39
• France: 84
• Germany, : 94
• India: 113
• Italy: 118
• Mexico: 166
• Work shirts / service shirts: 214
• Spain: 217
• United Kingdom: 242
• United States: 244

For example, to set the region to the United States, the full command would be:

• Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Control Panel\DeviceRegion" -Name "DeviceRegion" -Value 244 -Type DWord

There is no need to create or delete the key or the subfolder: Windows protects the structureHowever, it allows you to overwrite the value when UCPD is not active. Once the change is made, when you return to the regional settings you will see that the country has been updated without any problems.

Reactivate UCPD after making changes

Once you have finished adjusting the device region or modifying file/protocol associations using scripts or specific tools, it is recommended to Reactivate UCPDLeaving it permanently disabled opens the door for less reliable applications to silently change your default browser, PDF reader, or other key settings without you noticing.

To restore standard behavior from PowerShell with administrator privileges, you can reconfigure the UCPD service with an automatic (or system) startup type and reactivate the scheduled task. For example, if you want the service to be configured to start manually or automatically using the Windows Services APIs, you can use:

• Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\UCPD" -Name "Start" -Value 3 (so that the service has manual/automatic start as appropriate)

In parallel, it is advisable to reactivate the "UCPD velocity" task so that the system itself recovers its self-correction and monitoring logic:

• Enable-ScheduledTask -TaskName "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity" -ErrorAction SilentlyContinue

After executing these commands, the most prudent course of action is to perform a new computer restart so that the driver reloads with the correct configuration. From then on, the protection will again act on the UserChoice and DeviceRegion keys, reducing the risk of third-party applications attempting to take control without permission.

In contexts where you prefer to work with the classic console, you have equivalent alternatives with sc.exe y schtasks.exe, For example:

• sc config UCPD start=auto (to enable it)
• schtasks /change /Enable /TN "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity"

Similarly, if you wanted to disable it again from CMD, you could use:

• sc config UCPD start=disabled
• schtasks /change /Disable /TN "\Microsoft\Windows\AppxDeploymentClient\UCPD velocity"

Typical use cases: deployments, compatibility, and troubleshooting

Although UCPD may go completely unnoticed by a home user, in professional environments and for advanced users it generates fairly specific scenarios where you need to know how to handle it. The most common ones occur in massive equipment deployments, image customization tools, and profile migrations.

In an automated deployment, system administrators often need scripts or utilities (such as NTLite, ProfileUnity, PowerShell DSC, etc.) to preconfigure default applications From the users: browser, email client, PDF viewer… If UCPD is active, these scripts may fail with access denied errors when trying to establish default associations using UserChoice keys.

Something similar happens with some legitimate applications that manage file associations, which historically wrote directly to the user's Registry. The introduction of UCPD has forced many developers to update your tools to adapt to the new requirements or seek Microsoft-authorized solutions.

Another frequent case is that of the workstation migrationswhere profiles, configurations, and associations between devices are transferred. Some solutions have had to introduce special versions of their agents that, during migration, disable UCPD at startup (pre-script) and re-enable it at completion (post-script), as is done with packages like UCPDStartup.ps1 and UCPDComplete.ps1.

There have also been documented scenarios where poorly managed UCPD caused Windows Explorer crashes or strange behavior (explorer.exe), such as unexpected closures or flickering desktop icons. In these cases, a typical troubleshooting sequence involves temporarily disabling UCPD, restarting, cleaning or deleting certain association keys in HKEY_USERS (http, https, pdf, FileExts), and then re-enabling the driver and restarting again.

Safety, comfort and the regulatory background of the UCPD

Behind this entire protection system lies a constant tension between safety and comfortFrom Microsoft's point of view, the idea of ​​preventing third parties from changing default applications without permission is reasonable: for years, programs have been seen assigning themselves as the default browser or PDF reader without asking for permission or hiding the option among unclear checkboxes.

UCPD was created precisely for prevent such practicesThis ensures that only the user, through system dialog boxes and wizards, has the final say on which application behaves as the default. However, the chosen approach has also put legitimate tools that administrators use to provide a consistent experience to hundreds or thousands of users in a difficult position.

In Europe, there has been speculation that the creation of this controller could be related to regulatory requirements, particularly with the Directive on Unfair Commercial Practices (Unfair Commercial Practices Directive), which curiously shares the acronym UCPD. The idea would be to ensure that Windows does not allow other software to silently "steal" the place of the applications chosen by the user, especially in sensitive areas such as web browsers.

To date, Microsoft has been strengthening the driver with new versions and patches that close loopholes some manufacturers had found, such as using renamed binaries signed by Microsoft to circumvent the deny list. Solutions that worked in 2024 may stop working with newer driver versions, forcing periodically review configuration strategies.

With all this in mind, the key is to find a balance: use the official Windows options whenever possible to define default apps, and resort to temporarily disabling UCPD only in controlled and well-documented scenarios, avoiding leaving the system permanently without this layer of protection.

By understanding how UCPD works internally, what keys it protects, what processes it monitors, and how it integrates into startup and the Task Scheduler, you can make much more informed decisions about when to keep it active and when it makes sense to temporarily disable it for specific tasks such as adjusting the device region or completing a migration without access denied errors.