UCPD.sys: The Hidden Driver That Locks You Out of Your Own Computer

You’re an administrator. You took full ownership of the registry key. You have every permission Windows can grant. And the write still fails with a silent “access denied,” with no explanation for why. Somewhere between you and the disk, an invisible force you never consented to is deciding what you’re allowed to change on the machine you own.

Meet UCPD.sys.

The driver Microsoft never told you about

In 2024, Microsoft added a new piece of software to Windows: a minifilter driver. A minifilter sits in the middle of the stack, between the operating system forwarding your write request and the disk driver that actually writes the change to disk. At that layer, it has the power to allow or deny any write that passes through.

UCPD.sys, the User Choice Protection Driver, is exactly that kind of filter, and it’s built to listen to registry writes and block the ones it deems unworthy. It runs as a background Windows service at all times, yet you can’t find it in the services manager, because it’s a file system driver, not a normal service. And you can’t just turn it off the way you’d stop any other service, because drivers are either loaded at boot or they aren’t. It’s invisible, it’s always on, and it’s blocking you.

Why it exists: a problem Microsoft had to solve

To understand UCPD, you have to understand the tightrope Microsoft is walking. In the old days, Windows was a free-for-all. Almost nothing stopped you from changing anything, which meant every piece of software you installed could grab the default browser for itself and jam the system with toolbar slop to make money off your clicks. That was the wild west, and it was genuinely bad.

But Microsoft’s solution to the problem has long been to point the gun the other way. It absolutely doesn’t want you using any browser other than Edge, and for years it made changing your default an ever-increasing hassle. Then in 2022, the EU’s Digital Markets Act stepped in and told gatekeepers like Microsoft: you must not prevent or make difficult the use of competitor software. Microsoft had to make changing your default browser easy again, while simultaneously not reopening the door to scammy companies hijacking every default.

UCPD.sys is Microsoft’s answer to both demands at once. Its stated job is to “protect user choices” by stopping unintended edits to the registry keys that represent those choices. And on the surface, that’s a legitimate reason to exist.

The part that feels like malware

But here’s where it stops being reassuring. The protections UCPD enforces go well beyond “stop the scammy toolbar from hijacking your default.” Digging into the driver’s strings shows it guards four groups of things: default applications (browsers, PDF readers, Office), certain Windows features like news feeds and web search that people disable, the device region setting, and values that control UCPD’s own operation.

That last part is the eyebrow-raiser. The driver backs itself up inside the registry, and a scheduled task called “UCPD velocity” runs a manager executable at every logon whose job is to make sure the protected keys stay unchanged, and to restore them if they’re not. If you manage to disable the UCPD service, this watchdog silently re-enables it on the next logon, then loads it on the reboot after that. The thing literally resurrects itself. Users looking at this behavior reach for the only comparison that fits: malware persistence tactics.

And the device region part is where the mask slips entirely. Microsoft lets you uninstall Edge completely on EU installations of Windows, because the DMA demands it, but not on a US or rest-of-world installation. So Microsoft locked down the device region setting specifically so that tools can’t just spoof your region on the fly to remove Edge. UCPD isn’t only protecting you from bad actors. It’s protecting Microsoft’s own preference from you.

Only trusted hands may touch the keys

Security researcher Xusheng Li dug into the driver and mapped out the actual rule: only trusted binaries, meaning those signed by Microsoft, may change the protected keys, and even that excludes utility tools like reg, PowerShell, and regedit, which could be used to work around the protection. The intended flow is that changes only happen through “official” avenues like the Settings app, so a measly batch script can’t walk around the blocks.

The side effect is the enshittification. A driver that was meant to stop third parties from choosing for you ends up stopping you from choosing at all. You can still work around it, for now, by disabling UCPD and its watchdog and rebooting, but that very act feels like a workaround, and Microsoft has already closed this avenue before. The driver is on version 4.6, and each version has locked down bypasses the previous one allowed. There’s a real chance that one day the only way through is Safe Mode.

UCPD is a living contradiction: a driver that protects user choices by preventing users from making them. It walks the line between empowering you to choose and disempowering everyone else from choosing for you, and it’s quietly decided that Microsoft alone gets to hold the knife on that line. You’re the administrator of your computer, in name, until the day you try to administrate.

The receipt

• The scam: A hidden kernel driver blocks registry changes, including your own, even with full admin rights, and a watchdog task silently restores it when you disable it.
• The mechanism: A minifilter that denies protected registry writes, plus a scheduled task that re-enables the service at every logon.
• Why it’s still running: It’s the least-bad way to satisfy the EU’s DMA while still steering defaults to Microsoft; the driver itself is protected from being turned off.
• The fix that’s missing: Blocking bad actors shouldn’t mean locking out the owner. A genuine user choice lets you opt out of the protection and keep it off.

---

This is a real driver, documented in the walkthrough below.

Watch: Microsoft Added This Driver to Windows and Said Nothing (FlyTech Videos)