DefaultAppGuard Community

DefaultAppGuard is a Windows 11 utility that monitors the current user's video file associations and checks whether they still resolve to Microsoft Media Player.

When a real audit finds drift, the background Agent can show a throttled Windows tray notification. The Settings page can disable alerts without disabling the COM query, registry monitor, or periodic readback.

The Agent writes a bounded local CLEF operational log for troubleshooting. Logs are not uploaded, use a 2 MiB rolling threshold with seven retained files, and are never used as default-association evidence.

The project is currently an alpha. It detects drift and opens Windows' supported Default Apps surface for user-driven repair. It does not silently overwrite UserChoice, bypass UCPD, or claim an unbreakable hard lock.

中文简介：这是一个面向 Windows 11 的默认应用监控工具。它用 Windows COM 接口核验视频格式的实际默认程序，并在被其他软件改动后提示用户通过系统 “默认应用”页面恢复。Windows Home 不支持可靠的静默强制锁定，因此本项目不会 伪造“永久锁定”能力。

Download

Download the versioned ZIP and its .sha256 file from GitHub Releases. Extract the complete archive, read ENVIRONMENT-AND-RISKS.txt, and double-click DefaultAppGuard.Setup.exe. The PowerShell installer remains available for source review and advanced operation.

The current alpha is unsigned. Verify the checksum before installation:

Get-FileHash .\DefaultAppGuard-0.1.15-win-x64.zip -Algorithm SHA256

Read ENVIRONMENT-AND-RISKS.txt before installation. It provides the supported environment, unsigned-software warning, privacy boundary, known limitations, and license notice in Chinese and English. The release gate requires this file to be reviewed and version-matched for every release.

Version 0.1.15 packages contain a per-file SHA-256 manifest. The graphical Setup launcher runs without a console or administrator elevation. Before starting PowerShell, native Setup code independently verifies the package manifest, file set, lengths, and SHA-256 hashes. Setup uses ExecutionPolicy Bypass only for its hidden child process so a verified package extracted from a web download can run; it does not save or change the user or computer policy, and Group Policy still takes precedence. The transactional installer verifies the package again before stopping an existing Agent, stages the complete update, and restores the previous files and scheduled task if the new Agent fails its identity, primary-algorithm readiness, no-console, notification, or bounded operational-log checks. Readiness requires Microsoft Media Player target resolution and primary COM-query evidence for every protected format, with zero failed reads and a bounded evidence age; association drift itself does not block installation. The short-lived watchdog requires both process liveness and this freshness-aware readiness contract. Successful installation also creates a current-user entry in Windows Installed apps with a hidden, ownership-checked uninstall command. A late failure restores the previous package, task, install state, shortcut, and uninstall registration as one transaction.

Release assets also include a Microsoft SBOM Tool-generated SPDX 2.2 software bill of materials and checksum. The release gate validates the SBOM against the exact package, then installs that package in isolation and verifies the real monitor, transactional rollback, the short-lived native watchdog's exact arguments, current-user privilege, triggers, execution limit and restart settings, automatic recovery, diagnostics, and clean uninstall before publication.

Configuration updates are written through a same-directory temporary file, flushed to storage, and committed with Windows replacement semantics while retaining runtime/guard-configuration.json.bak as the last-known-good copy. At startup, invalid JSON or unsupported configuration content is restored from that validated backup. If neither copy is valid, the Agent restores the safe default of all 34 supported video formats with notifications enabled. Storage permission and I/O failures remain fatal instead of being mistaken for damaged content. Health and redacted diagnostics expose whether recovery occurred. The application also displays a persistent recovery notice. It distinguishes a last-known-good backup restore from a safe-default restore where custom choices may have been lost, links directly to the protected-format review, and stores notice acknowledgement locally without changing protection settings.

For unsigned alpha fallback releases, GitHub builds and attests one immutable candidate archive on the explicit windows-2025 hosted label. The build record includes the requested label, actual image family and image version. A separate Windows validation computer verifies those attestations and runs the real 34-format primary COM and registry-notification lifecycle against the exact archive without rebuilding it. The release remains blocked unless both the hosted build evidence and local main-algorithm evidence pass.

Pull requests run the complete portable suite independently on the explicit windows-2022 and windows-2025 GitHub-hosted labels. These Windows Server jobs detect build and packaging regressions only. They do not have a supported desktop default-app environment and never replace the Windows 11 main-algorithm release gate.

See docs/USER-GUIDE.md for installation, use, diagnostics, and uninstallation.

Main Algorithm

1. Resolve the installed Microsoft Media Player target dynamically.
2. Query every protected extension through IApplicationAssociationRegistration.QueryCurrentDefault.
3. Treat UserChoice only as cross-evidence, never as a fallback.
4. subscribe to the current user's FileExts tree with RegNotifyChangeKeyValue and REG_NOTIFY_THREAD_AGNOSTIC.
5. Re-query the effective handlers after a real notification.
6. Run a periodic COM readback in case Windows performs a change that does not produce a registry notification.
7. Expire readiness when the last complete primary audit exceeds the bounded interval derived from the configured periodic readback.
8. Send repairs through the official Windows Default Apps UI.
9. Present drift found by those primary algorithms through a best-effort WindowsForms.NotifyIcon alert; never use the notification layer as evidence.
10. Persist bounded local operational events for diagnosis; never use a log entry as query or monitor evidence.

See docs/ALGORITHM-DECISIONS.md for rejected approaches and product boundaries.

Repository

• native/DefaultAppGuard.Core: COM query, target resolution, planning, and registry notification.
• native/DefaultAppGuard.Agent: loopback API, monitor worker, persisted configuration, and packaged UI host.
• native/DefaultAppGuard.Setup: NativeAOT graphical package launcher and short-lived no-console watchdog.
• native/DefaultAppGuard.Tests: unit tests plus real Windows integration tests.
• src: React application.
• packaging: self-contained publish, current-user install, and uninstall.

Build Toolchain

Release builds use the exact versions recorded in the repository:

• .NET SDK 10.0.302 from global.json, with roll-forward disabled.
• Node.js 24.18.0 LTS from .nvmrc and package.json.
• pnpm 11.9.0 from packageManager and package.json.

The release package remains self-contained; these tools are required only to build or verify the project, not to install it.

Verification

pnpm install --frozen-lockfile
.\packaging\Test-ReleaseGate.ps1 -Version 0.1.15 `
  -PackageManagerPath pnpm

The release gate runs the real COM and kernel registry-notification tests separately and verifies their names in the test result. It requires Microsoft Media Player to be installed and configured for every declared video format. It also rejects a published Agent or Setup watchdog unless its PE subsystem is Windows GUI, which prevents a scheduled recovery check from opening a console window. The gate additionally forces a failed startup, verifies process cleanup and bounded recovery backoff, and records the exact toolchain versions. Hosted CI alone is intentionally insufficient for a release. The dedicated release machine must not already be running another DefaultAppGuard Agent because the product intentionally allows one instance per signed-in user.

Build A Windows Package

.\packaging\Publish-Windows.ps1 -CreateArchive

The script builds the React UI, a small NativeAOT graphical Setup launcher, and a compressed, self-contained win-x64 Agent. The output includes installation and uninstallation scripts, the redacted diagnostics script, a per-file integrity manifest, third-party notices and license text, and the versioned bilingual environment and risk notice. See docs/USER-GUIDE.md and docs/MAINTAINER-GUIDE.md.

Release And Trust

• The binary and PowerShell scripts are not code-signed.
• The alpha has only been installation-tested on Windows 11 25H2, x64.
• Release evidence records the Authenticode status of every executable, installer, uninstaller, diagnostics script, and package module. A partially signed or invalidly signed release is rejected.
• The require-signed path can sign the fresh payload with a code-signing certificate available through the Windows certificate store or an attached HSM before the package manifest is generated. Version 0.1.15 remains an unsigned alpha unless its release notes explicitly state otherwise.
• Unsigned fallback candidates carry GitHub build attestations for the ZIP, SBOM, and build record. These establish build provenance but do not replace a trusted Windows Authenticode publisher signature.

See docs/RELEASE.md for the GitHub release gate and docs/CODE-SIGNING.md for the SignPath Foundation and Microsoft Artifact Signing options.

License

DefaultAppGuard is source-available under the PolyForm Noncommercial License 1.0.0. It may be used, changed, and redistributed for permitted noncommercial purposes under those terms. Commercial use is not granted.

This is a noncommercial source-available license, not an OSI-approved open source license. Redistributions must include both LICENSE.md and NOTICE.