Microsoft adds driver to Windows that prevents changing the default browser using the registry

There are various ways you can change the default browser and similar defaults on Windows, but oneof the ways many third-party tools do this is by editing the relevant registry strings. It turns out that Microsoft is not particularly happy with this, as they’ve recently introduced a new driver specifically designed to prevent this from happening, by blocking tools like regedit or PowerShell from editing a number of registry keys for setting default applications. The driver was discovered by Christoph Kolbicz.

Microsoft implemented a driver based protection to block changes to http/https and.pdf associations by 3rd party utilities. The rollout was staggered and activated “randomly”, but in the meantime I got many reports – also from business or education environments (but not Server OS).

Microsoft also updated the driver during my tests (from 2.0 to 2.1) and extended the deny list of executables. This means, they can change the behavior almost on the fly and add new tricks or block additional extensions/protocols!
↫ Christoph Kolbicz

Digging further into what, exactly, this driver can do, Microsoft also made it so that even if you disable the driver, an additional scheduled task will run to re-enable the driver and revert the registry changes. It also seems this is somehow related to the changes Microsoft has to make to comply with the EU’s DMA, but the driver is also installed on systems outside of the EU, so it’s all a bit unclear at the moment.