I checked where the relevant files are when installing KeePass 2 for windows. There is a global configuration file at "C:\Program Files\KeePass Password Safe 2

I checked where the relevant files are when installing KeePass 2 for windows. There is a global configuration file at "C:\Program Files\KeePass Password Safe 2\KeePass.config.xml" but by default, this one just contains a directive to use the user's configuration. This one also needs elevated privileges to edit. The user's configuration file is at "C:\Users\<username>\AppData\Roaming\KeePass\KeePass.config.xml" So if you want to avoid an attacker being able to change the user's configuration without elevation, then you can just change the security settings of that last file, e.g. by taking away the user write permission. However, the user is probably launching the KeePass executable via some sort of shortcut. For example, a pinned shortcut on the taskbar. This would also be a user file, at "C:\Users\<username>\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\KeePass 2.lnk" So if the attacker can modify the user's files, then they can probably also modify that shortcut, e.g. to point at a modified copy of keepass. This shows that the behavior of the "real" KeePass application is probably not very relevant here. It is difficult to defend against an attacker with that level of access.