Microsoft added an undocumented driver to Windows that silently blocks changes to specific registry keys, defends itself from removal, and can resurrect after being killed. Its name is UCPD (User Choice Protection Driver). Why does it exist? Why is Microsoft silent about it? And how do you get rid of it? Useful downloads: - Procmon - https://learn.microsoft.com/en-us/sysinternals/downloads/procmon - Strings - https://learn.microsoft.com/en-us/sysinternals/downloads/strings Blog posts about this for further reading: - Xusheng Li - https://binary.ninja/2025/03/25/default-browser-upcd.html - Christoph Kolbicz - https://kolbi.cz/blog/2024/04/03/userchoice-protection-driver-ucpd-sys/ - Gunnar Haslinger (post in German) - https://hitco.at/blog/windows-userchoice-protection-driver-ucpd/ Resources from the video: - EU Digital Markets Act - https://digital-markets-act.ec.europa.eu/index_en - Minifilter drivers - https://learn.microsoft.com/en-us/windows-hardware/drivers/ifs/filter-manager-concepts - Windows Feature Store (Velocity) - https://msft.chat/wiki/windows-feature-store.html - China - https://en.wikipedia.org/wiki/China ---------- Join this channel to get access to perks: https://www.youtube.com/channel/UCEaEuLUvy4Y1DqpxiDvnxeQ/join GET YOUR BSOD PILLOW HERE: https://store.flytech.video Join the channel's discord server "The Flying Tech"! https://flytech.video/discord ---------- #windows11 #windowsinternals #microsoft #cybersecurity #flytech
ADVERTISEMENT
"I am administrator and I cannot administrate" is so relatable
"User Choice Protection Driver" right, because it's not my computer, it's "This PC"... thank you Microslop
The name is accurate, it protects the OS from user choices
User Choice Prevention Driver
Using Windows before felt like using a tool, now it feels like getting a babysitter.
I disabled it by switching to linux
"I'm sorry Dave, I'm afraid I can't do that"
A voiced FlyTech Video? In this economy?
Turns out the Linux community does have a marketing department, it's called Microsoft Windows
While device region is protected, there's a bypass. You can change your current location in settings, then close the settings, DELETE the DeviceRegion key (editing is protected, but deleting is allowed!) and open the settings again, Windows will make a new DeviceRegion from current location.
0:18 Hasn't been "my own OS" for a while now. Not with windows, anyway..
Securing windows users❌❌❌ Securing windows from its users✔️✔️✔️
Honestly I do see the point of this driver. However, I think it should've been implemented in a way that recognizes when it's the user itself wanting to make changes to the registry and allow those.
Should be an option to disable it inside Windows Defender. Also it's surprising it doesn't protect Windows Defender choices
When an OS starts working against me instead of assisting me, it's time to wake up and realise there's no point in using it.
I feel that this driver is completely unnecessary. It prevents debloat software from changing the defaults. And if I get hit with the actual virus, then changing the default browser is the least of my problems. Based on what it prevents, it seems to protect the business interests of Microsoft more than the interests of the actual user.
The driver should generate a UAC prompt, and let the computer's owner decide.
To be fair, if you could turn it off inside Windows easily then so could viruses, and the entire point of this driver was to prevent viruses from changing your stuff (like your default browser) without your consent.
The fact that MS did not document this driver makes their intentions feel very suspicious.
I cannot comprehend the absurdity of that "system driver". They are literally checking for every write to the registry if the writer is in a list of chinese software vendors. That surely must waste some CPU cycles.