The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →To configure default file handlers with SCCM, create the desired associations on a reference Windows computer, export them with elevated DISM, and deploy an SCCM package that runs an online DISM import. Microsoft’s accepted SCCM example uses an XML file beside a batch script containing Dism.exe /Online /Import-DefaultAppAssociations:"%~dp0AppAssociations.xml"; it recommends piloting the package on one client before broad deployment. The answer was written for Windows 10, so Windows 11 behavior must be validated on the builds and user states you manage.
For sign-in enforcement rather than a one-time package action, use the Windows policy named Set a default associations configuration file. For image engineering, import the XML into an offline WIM or VHD with DISM. These are separate delivery models, and choosing the right one determines when associations apply and which management authority wins.
As an Amazon Associate I earn from qualifying purchases.
What SCCM is configuring
A Windows file association maps a file-name extension or protocol to an application registration. An XML association file records those mappings so Windows can apply a known baseline instead of relying on each user to choose an app manually. The XML is not a list of arbitrary registry edits: applications must register the file types and protocols they support, and modern Windows protects a user’s default choices from machine-level changes made by installers. Microsoft documents this registration model and the limits on applications changing defaults after installation in Application Registration for Win32 apps.
SCCM (Microsoft Configuration Manager) is useful when the target is an already deployed client. A package copies the association file and invokes DISM against the running operating system. A policy is more appropriate when associations should be evaluated at sign-in, while offline servicing belongs in an image-building or task-sequence workflow.
#1 Best Overall
| Approach | Target | When it acts | Important behavior |
|---|---|---|---|
| SCCM package and online DISM | Existing Windows clients | When the program runs | Microsoft’s published example is Windows 10-specific; pilot on every Windows release you operate. |
| Group Policy or MDM policy | Managed devices | At user sign-in | For this setting, MDM takes precedence over Group Policy even when MDMWinsOverGP is not configured. |
| Offline DISM import | Mounted WIM or VHD | During image servicing | Imports replace the image’s association set; merge all intended entries before importing. |
The policy and image behaviors are documented by Microsoft in Policy CSP – ApplicationDefaults and Export or Import Default Application Associations.
Prerequisites and a safe rollout plan
- A reference computer running the same Windows edition and a comparable build as the clients that will receive the setting.
- Every application that should handle a file type installed and fully registered on the reference computer.
- Local administrator rights for the elevated DISM export and for any test import.
- An SCCM package source folder containing the XML and import script.
- A pilot device collection that represents the production hardware, Windows builds, architecture, and user profile conditions.
- A rollback or replacement XML that restores your approved baseline if a mapping causes an application or workflow problem.
Do not export immediately after provisioning a new reference computer. Microsoft warns that delayed-install applications can leave an export incomplete. Finish application installation, open the exported file for inspection, and compare it with DISM’s list of available defaults before packaging.
Build and verify the association XML
1. Configure a reference computer
- Install the applications that are approved to handle the required extensions and protocols.
- Open Windows Settings and select the defaults explicitly. In current Windows, use Settings > Apps > Default apps, search for an extension or protocol, and select the registered application.
- For an association that appears to have only one possible handler, select it again deliberately. Microsoft notes that an association handled by only one application can be implicit and absent from an export until it is explicitly selected or reselected.
- Wait for delayed-install applications and registration tasks to finish, then sign out and back in if the application’s installer requires it.
2. Export with elevated DISM
Open Command Prompt as an administrator and export to a folder that exists:
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Dism.exe /Online /Export-DefaultAppAssociations:"C:SourceAppAssociations.xml"/Online targets the running operating system. The quoted path can be changed, but keep the XML in a location you can inspect and copy into source control or your SCCM content share.
3. Inspect for completeness
Open AppAssociations.xml in a text editor and check that every required extension or protocol is present with the expected application registration. Then compare the export with:
Dism.exe /Online /Get-DefaultAppAssociationsThe output and XML should agree for the mappings you intend to deploy. If an extension is missing, return to Default apps, select the handler explicitly, and export again. Do not invent a ProgID by guessing its text: use the value generated by the registered application. Refresh the baseline file whenever a major Windows release changes application registrations or supported extensions.
What the XML represents
An exported file contains a DefaultAssociations root and one or more Association elements. Each element identifies an extension or protocol and the registered application’s ProgID and name. A simplified structural example is:
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors<DefaultAssociations>
<Association Identifier=".example" ProgId="Contoso.App" ApplicationName="Contoso Example" />
</DefaultAssociations>The values in a production file should come from your export, not from this illustrative structure. Keep the XML encoding and syntax intact; malformed XML will prevent import.
Create the SCCM package
1. Prepare the source folder
Create a dedicated folder, for example \SCCMSourceFileAssociations, and place these two files together:
AppAssociations.xml, exported from the reference computer.ImportAssociations.cmd, the script that invokes DISM from its own directory.
Keeping the files together lets the script use %~dp0, which resolves to the script’s directory regardless of the SCCM cache path.
2. Write the import script
@echo off
setlocal
"%windir%System32Dism.exe" /Online /Import-DefaultAppAssociations:"%~dp0AppAssociations.xml"
exit /b %errorlevel%The Microsoft Q&A example uses the equivalent command Dism.exe /Online /Import-DefaultAppAssociations:"%~dp0AppAssociations.xml". Calling DISM through %windir%System32 makes the executable path explicit. The script returns DISM’s exit code so SCCM can report a failure instead of marking a broken import as successful.
Free tools Windows power users keep installed
One-click scans. No signup required.
3. Create and distribute the package
- In the Configuration Manager console, open Software Library > Application Management > Packages and choose Create Package.
- Give the package a name that identifies the Windows baseline and association revision. Specify the source folder containing the XML and script.
- Create a standard program whose command line is
ImportAssociations.cmd. Set it to run with administrative rights and use the system context; an interactive user session is not required. - Choose the operating-system requirements that match the clients you have tested. Avoid advertising the program to unsupported Windows builds simply because they are in the same collection.
- Distribute the package content to the distribution points used by the pilot collection.
- Deploy it to a small device collection first. After validation, use a phased deployment or a broader collection.
Console labels differ slightly by Configuration Manager current-branch release, but the essential settings are the package source, a standard program that runs the batch file, distribution to a distribution point, and a deployment to a device collection. The accepted Microsoft example specifically recommends deploying to a test client before expanding the deployment; it does not prove that every execution context or current Windows release behaves identically. See Microsoft’s Windows 10 SCCM example for that procedure.
Pilot validation before production
Validate the result on the actual Windows builds and user/device states that matter. A package can report that DISM ran while a user still sees a different handler because the application was not registered yet, the association was not in the XML, or the test was performed under a different profile than the production workflow.
- Confirm the SCCM client downloaded both files and that the program log records the expected command and a successful exit code.
- On the pilot device, inspect the deployed XML and rerun
Dism.exe /Online /Get-DefaultAppAssociationsfrom an elevated prompt. - Sign in with the profile type used by production, then open a representative file for each extension and protocol.
- Test applications that depend on protocol handlers, not only document extensions.
- Repeat after a reboot and after the target application’s first-run registration, if applicable.
- Record the Windows build, architecture, user state, application version, deployment time, and observed handler. This makes a later discrepancy diagnosable rather than anecdotal.
Run a pilot on Windows 10 if that is your production platform and separately on Windows 11. The cited SCCM answer is scoped to Windows 10, while Microsoft’s current DISM documentation is presented for Windows 11; neither source establishes identical online-import behavior for every Windows 11 configuration.
Use the policy method when sign-in enforcement is required
Windows provides the policy Set a default associations configuration file. In Group Policy, find it at Computer Configuration > Administrative Templates > Windows Components > File Explorer, then point it to the approved XML. The same setting is represented by the ApplicationDefaults policy CSP. Microsoft describes its purpose as allowing an administrator to set default file-type and protocol associations.
The CSP is device scoped and applies configured associations at sign-in. For this policy, MDM has precedence over Group Policy even if MDMWinsOverGP is not configured. Therefore, document which authority owns the XML and avoid assigning competing files through SCCM, Group Policy, and MDM without a deliberate precedence plan.
Windows 11 versioning behavior
Starting with Windows 11, version 22H2, the policy supports a Version attribute on DefaultAssociations and a Suggested attribute on an Association. Incrementing Version causes suggested associations to be reapplied once. Associations that are not marked suggested apply at each sign-in. Use this behavior when users should retain their choices except when an administrator intentionally publishes a new suggested baseline; test the exact XML and version increment on a pilot build.
Policy delivery and SCCM package delivery are not interchangeable. A package runs according to its deployment schedule, whereas the policy is evaluated during sign-in. If a user must be able to change a default after the baseline is applied, choose the policy attributes and deployment authority accordingly rather than repeatedly forcing the package.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Import associations into an offline image
For a reference image or task sequence, Microsoft supports importing associations into an offline Windows image. Mount the image, import one combined XML, review the result, and commit the image:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteDism /Mount-Image /ImageFile:C:Imagesinstall.wim /Index:1 /MountDir:C:Mount
Dism /Image:C:Mount /Import-DefaultAppAssociations:C:SourceAppAssociations.xml
Dism /Image:C:Mount /Get-DefaultAppAssociations
Dism /Unmount-Image /MountDir:C:Mount /Commit- Make sure the mount directory exists and is not in use.
- Mount the correct WIM index, or mount the VHD using the equivalent offline servicing workflow.
- Import the XML into the mounted image.
- Use
/Get-DefaultAppAssociationsagainst the mounted image to review what was imported. - Commit only after the association list and image health are acceptable. If the review fails, unmount without committing, correct the XML, and repeat.
Offline imports are not cumulative. Importing a second XML does not safely append a few additional rows; merge all desired entries into one XML and import that complete set. Maintain a separate baseline for each major Windows version because application registrations and supported extensions can change. The full DISM workflow is documented in Microsoft’s export and import guide.
Troubleshoot common failures
The package succeeds but the expected extension still opens elsewhere
- Check that the extension is actually present in the XML and that its ProgID matches a registered application on the target.
- Confirm the application was installed and registered before the import ran. Installing an app later does not guarantee that the earlier XML import will be regenerated.
- Check the user profile and sign-in timing. Test the association under the same profile state used in production.
- Verify that a Group Policy or MDM configuration is not applying a different XML. MDM wins over Group Policy for the ApplicationDefaults setting.
- Have the user select the intended default once if the association was implicit or if Windows is presenting a first-use choice.
The XML is missing an association
Delayed installation and implicit single-application handlers are the usual causes documented by Microsoft. Finish all installs, explicitly select the handler in Default apps, run the export again, and compare it with /Get-DefaultAppAssociations. Do not copy a guessed ProgID from another machine or Windows release.
DISM returns an error
- Run the command in an elevated context; the SCCM program should use administrative rights and the system account.
- Verify the XML path, quotation marks, file name, and distribution-point content version.
- Open the XML and check that it is well formed and was not damaged by editing or encoding conversion.
- Run the same command locally on a pilot device to separate an XML problem from an SCCM content or scheduling problem.
- Check the SCCM client logs for download, detection, and program-execution errors, then compare the logged command with the tested script.
A user’s later choice keeps returning to the baseline
Determine whether the device also receives the ApplicationDefaults policy. Non-suggested policy associations apply at each sign-in, while a Windows 11 22H2-or-later policy with a changed Version reapplies suggested entries once. Remove the competing assignment or adjust the XML’s policy attributes if user control is required.
Windows 11 behaves differently from Windows 10
Treat this as an expected validation boundary, not as proof that the package is defective. The SCCM recipe in Microsoft’s accepted answer is a Windows 10 example. Test online DISM import, sign-in behavior, application registration, and user overrides on each Windows 11 release you intend to support, and refresh the association baseline when a major release changes registrations.
Operational checklist
- Applications are installed and registered on the reference computer.
- Defaults were selected explicitly in Settings.
- The elevated DISM export was inspected and compared with
/Get-DefaultAppAssociations. - The XML and script share one SCCM source folder.
- The script uses the packaged file’s path and returns DISM’s exit code.
- The package is distributed and piloted on representative Windows 10 and Windows 11 devices.
- Policy, MDM, image, and SCCM ownership is documented so two authorities cannot silently overwrite one another.
- A complete replacement XML is available for rollback, because repeated imports do not accumulate entries.
Use SCCM’s online import for controlled deployment to existing clients, the ApplicationDefaults policy for sign-in-based management, and offline DISM servicing for images. In every case, base the XML on real application registrations and validate the result on the Windows builds, profiles, and deployment timing your organization actually uses.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
