GPO File Association fails with “0x80070005 Access is denied” error

Windows file association can be changed using Group Policy (User configuration > Preferences > Control Panel Settings > Folder Options  > New > Open With).

Group Policy Management Editor

In some cases GP fails to apply the file association on user logon, and following error is logged in Windows Application Logs:

Event 4098 - 0x80070005 Access is denied

Event ID: 4098
Level: Warning
The user “jpg” preference item in the ‘<GPO Name and ID>’ Group Policy object did not apply because it failed with error code ‘0x80070005 Access is denied.’ This error was suppressed. 

This can occur is a user has already manually changed file association for that particular file extension. Doing so modifies permissions of a registry key UserChoice located in:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\<.extension>

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\.jpg\UserChoice

The modification involves adding Set Value – Deny permission to the UserChoice key for the user in question. This prevents GP from changing value of the Progid entry (which is inside UserChoice key and determines file association).

Registry Permission Entry for UserChoice key

To resolve the issue you can remove the “Set Value – Deny permission”, or alternatively get a user to change the file association manually (although this will not prevent from the error appearing in Application Logs).

Windows Server 2008
Windows 7 SP1


Comments

Leave a Reply

Your email address will not be published. Required fields are marked *