One Drive FileSyncConfig

[Sheridan]

One our test build of 10, non admin users are seeing that the %userprofile%\AppData\Local\Microsoft\OneDrive\FileSyncConfig.exe is being blocked by Applocker (which is correct!)

 

However we have OneDrive disabled in Group Policy, and this executable seems to run under the users profile, but I can't find where its going from! I want OneDrive disabled and this seems to be running for every user. An admin doesn't notice it purely because the AppLocker policy is less restrictive.

 

Does anyone know where this is coming from, its a bit annoying seeing an Applocker error every time a user logs in!

[Sheridan]

Got the little blighter! It was OneDriveSetup.exe which somehow had crept into the Default User local profile. Pulled that out of the ntuser.dat file and its gone now!

[lmrogers]

Hi Sheridan,

 

Can you advise on how you removed the setup from the Default User local profile?

 

Many Thanks

[Sixiq]

Hi Sheridan,

 

Can you advise on how you removed the setup from the Default User local profile?

 

Many Thanks

 

Hi,

 

I've been looking into this issue as well lmrogers. First navigate to C:\Windows\SysWOW64\OneDriveSetup.exe. You will have to take Ownership of this .exe, as it's set to TrustedInstaller by default. Once you have complete ownership of this .exe you'll be able to delete it. Once removed, no more popups Just unsure on how Sheridan was able to edit the ntuser.dat without screwing everything else up... I would like to know this also

 

Wondering if it's at all possible to set this as a GPO for an enterprise network, doing this manually is the only way I know at the moment

 

-Zac

Edited March 23, 2016 by Sixiq

[Sixiq]

In GP Editor, under User Config\Policies\Admin Templates\System\ there's a GP named "Don't run specified Windows applications". Enable and enter OneDriveSetup.exe, works like a charm

[Sheridan]

Just seen the question here so I'll add how I did this as well.

 

I loaded the Default User profile in Regedit using Load Hive and selecting the NTUSER.DAT from c:\Users\Default. You'll need to have the option to 'Hide protected operating system files' unchecked to see the file.

 

Once the hive is loaded, got to HKLM\Software\Microsoft\Windows\CurrentVersion\Run and delete the OneDriveSetup entry that is in there.

 

Unload the NTUSER.DAT and it should prevent and new users profiles from trying to run that on login.