<< Click to Display Table of Contents >> Navigation:  PDF-XChange Editor > Customization > Set PDF-XChange Editor as the Default PDF Application > Setting File Associations One Time > Enforcing File Associations via Group Policy

---

 

Enforcing File Associations via Group Policy

 

---

 

Upgrading from V9 or V10?

 

Read this first.

 

 

 

Setting file associations programmatically, without user interaction, has been progressively restricted since Windows 10. This is deliberate on Microsoft's part and is a security measure, it prevents applications from silently hijacking a user's chosen defaults. Windows protects the per-user UserChoice registry keys with a hash, and any attempt to write those keys directly will be detected and reverted.

 

The practical consequence for a system administrator is that associations cannot reliably be set by script, by installer switch, or by direct registry edit. They must be set by policy. This page describes the supported method and applies to domain-joined machines via Group Policy, and to standalone machines via the Local Group Policy Editor. For Intune or Entra managed devices, see Note 1 below.

 

It is important to note that users are free to change file association settings through PDF-XChange Editor or through the manipulation of the Windows registry. It is recommended to enforce file associations via a Group Policy in cases where it is necessary to deny users the freedom to make permanent changes to file associations. Users will still be able to make changes, but the settings defined in the policy will be reapplied and the file associations restored when the machine's Group Policy is next applied - either when the client logs in or when GPUpdate.exe is run.

 

Create a File Associations .xml File

 

The first step in the process is to create an .xml file that defines the file associations to enforce. The DISM tool at an administrative command prompt can be used to do this on a workstation with the following command:

 

Dism /Online /Export-DefaultAppAssociations:<XML path>\AppAssoc.xml

 

Figure 1. Exporting Current File Associations to an XML File

 

The output .xml file will list all file associations set on the machine. Please ensure these files are set up as desired before the command is run. To ensure it exports properly via the DISM command, do not assume that just because a file type is associated in the Windows settings that it will be exported.  It needs to be explicitly set as default. If you find file types missing from the .xml export after running the export command, go back to the Windows settings, find the file association by file extension and hit the "Set default" button:

 

 

This should ensure it gets exported.

 

The .xml file needs to be available to the clients for whom the Group Policy will be applied - therefore it is necessary to either add it to a shared network location or push it to your target machine's local file system. If the latter option is used then it is important that the location is not user-specific. For example, "C:\Windows\System32" can be used as long as it is copied locally to target machines.

 

Note that Group Policies are used to enforce file associations for all file formats. Therefore, the next step of the process is to remove the entries from the .xml file that contain the file formats not to be enforced. This example will detail how to enforce .fdf, .xfdf, .pdf, xclpack and .xcesession/.xcesessionbk for PDF-XChange Editor, .pdtex and .pdts for PDF-Tools and .xcvault for XCVault.exe, the utility for managing serial keys:

 

V11

Figure 2. App Association XML File with Recommended Entries for Version 11 PDF-XChange Editor, PDF-Tools and the XCVault Utility

 

V9 and V10

Figure 2. App Association XML File with Recommended Entries for PDF-XChange Editor, PDF-Tools and the XCVault Utility

 

 

Understanding the Version and Suggested attributes.

 

Windows 11 22H2 introduced two optional attributes that govern when the associations are applied.

Suggested on an <Association> element:

   • Suggested="false" — the default. The association is enforced at every user sign-in. A user may change it during a session; it reverts at next sign-in.

   • Suggested="true" — the association is applied once, and only reapplied when the Version attribute of the parent element is incremented.

Version on the <DefaultAssociations> root element records which revision of the file has been applied.

For enforcement — which is the purpose of this page — you want the default behavior. Either omit both attributes, as in the listing above, or set Suggested="false" explicitly.

If you are amending an existing deployment whose XML carries Suggested="true", you must increment Version or your revised file will have no effect. An unchanged Version is a second silent-failure mode, and it is easily mistaken for the first.

 

Using the File Associations File in a Group Policy

 

Please note that in Windows Server 2016 it may be necessary to download the Administrative Policy Templates and add the Windows Explorer (.admx) and (.adml) files from the policy templates to the policy definitions folder for the central store on your domain controller. The Microsoft Administrative Policy Templates are available here. The standard location for the policy definitions folder is:

 

C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions

 

Figure 3. Policy Definitions Folder, Administrative Templates Added

 

Follow the steps below to use the file associations file in a Group Policy.  

 
Please note that the screenshots are from a Local Group Policy Editor, but are the same on a Domain Controller.

 

1. Open the Group Policy Management Editor, then open the policy "Set a default associations configuration file". This policy is located in Computer Configuration\Policies\Administrative Templates\All Settings:

 

Figure 4. Loal Group Policy Management Editor, Set a Default Associations Configuration File Highlighted

 

2. Set the path to the .xml file created above. A network path can be used:

 

Figure 5. Set a Default Associations Configuration File Dialog Box

 

3. Update the Group Policy. Run GPUpdate.exe on the client or log off an on again to update the local policy. It will be located in:

 

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System

 

Figure 6. Registry Editor, Default Associations Configuration Policy Set

 

Verify

 

The associations are applied at user sign-in, not when the policy is fetched. gpupdate /force alone proves nothing. Sign out and sign back in before testing.

On the target machine:

:: Confirm the policy landed

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\System" /v DefaultAssociationsConfiguration

 

:: Confirm the ProgIDs in your XML exist on this machine

reg query HKLM\SOFTWARE\Classes /f "PDFXEdit." /k

 

:: Confirm what the user profile currently resolves to

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice"

If the first command returns the correct path and the third still names another handler, the fault is in the XML, not in the policy.

Please note:

 

1.MDM takes precedence over Group Policy. For this policy specifically, an MDM configuration overrides Group Policy even when the MDMWinsOverGP policy is not set.  On a co-managed or Intune enrolled device, an ApplicationDefaults / DefaultAssociationsConfiguration setting or the absence of one will take precedence over a correctly configured GPO. If a policy that previously worked has stopped working, establish whether the affected machines have been enrolled in Intune since the GPO was authored. The equivalent Intune setting is available in the Settings Catalog and takes the XML Base64-encoded.

 

2.Supported editions. Windows Pro, Enterprise, Education and IoT Enterprise, on Windows 10 1703 and later. The policy is not available on Home.

 

3.Windows Server 2016. The policy may not appear if the Windows Explorer administrative template is absent. Add WindowsExplorer.admx and its corresponding .adml to the central store.

 

4.Users can still change associations. A user may reassign a file type during a session. The policy reasserts the administrative setting at the next sign-in. This is by design.

 

5.New user profiles. A long-standing Windows behaviour requires a newly created user to sign in twice before the enforced associations take effect on first use.

 

---