Trouble with Silently configure OneDrive user accounts

[AlteredAdmin]

I cant seem to find an answer to this question.

 

 

 

I have a question about Silently configure user accounts for one drive, I have the below reg keys being created. to create the below reg keys I'm using SCCM Configuration Items/Configuration Baselines.

 

The test machine is Hybrid Azure AD joined, in Azure AD.

 

 

 

[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"SilentAccountConfig"="dword:00000001"

[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptInWithNotification"

[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMSilentOptIn"="1111-2222-3333-4444"

[HKLM\SOFTWARE\Policies\Microsoft\OneDrive]"KFMBlockOptOut"="dword:00000001"

[HKLM\SOFTWARE\Policies\Microsoft\OneDrive\DiskSpaceCheckThresholdMB]"1111-2222-3333-4444"=dword:0005000

 

However when a user signs into the computer, one drive does not auto sign in. it is running in the system tray. If i launch the OneDrive app it does prompt for an email. But never gets prompted for password. So once the user enters there email it signs them in.

 

 

 

I saw on https://docs.microsoft.com/en-us/onedrive/use-silent-account-configuration#verify-that-single-sign-on-sso-is-working that one can enable "EnableADAL" When i tried that i enter the mail and was not prompted for a password so i know that " auth environment is properly configured and SilentAccountConfig should work for your users "

 

 

 

I have also read that if you have MFS turned on it does not work, We do not have Azure MFA turned on. however we do have a 3rd party MFA Onelogin.

 

 

 

What am i still missing? Reading over all the documentation this should work. but I'm at a loss.

 

I also want to note that Intune/Autopilot AAD machines work fine it auto signs in.

 

 

 

Thoughts?

 

 

 

Thanks,

 

AA

 

 

 

 

 

SOLVED:Because i was setting SilentAccountConfig via SCCM Baseline. SCCM Baselines default to QWORD but the Value needs to be reg_dword, I had to check the box "create the registry value as a reg_dword data type if remediated for non compliant rules"

Edited December 8, 2021 by AlteredAdmin

[Boredguy]

We have the following Registry settings applied via GPP for users when they logon to stations and OneDrive is silently logging them in to OneDrive on Demand (other than when it decides to update)

 

HK_CU\Software\Microsoft\OneDrive\

EnableADAL = 1

ClientEverSignedIn = 0

SilentBusinessConfigCompleted = 0

FirstDeleteDialogsShown = 1

 

HK_CU\Software\Microsoft\OneDrive\Accounts\Business1\

FirstRunSignInOrigin = 0

UserEmail = %username%@ourdomainhere.com

FirstRun = 0

[AlteredAdmin]

We have the following Registry settings applied via GPP for users when they logon to stations and OneDrive is silently logging them in to OneDrive on Demand (other than when it decides to update)

 

HK_CU\Software\Microsoft\OneDrive\

EnableADAL = 1

ClientEverSignedIn = 0

SilentBusinessConfigCompleted = 0

FirstDeleteDialogsShown = 1

 

HK_CU\Software\Microsoft\OneDrive\Accounts\Business1\

FirstRunSignInOrigin = 0

UserEmail = %username%@ourdomainhere.com

FirstRun = 0

 

1. So i have tested the EnableADAL and there is no change in behavior. and Microsoft documentation says you don't have to do it.
   
2. The second part i have not seen those keys mentioned any where else do you have any more information on them?
   
3. UserEmail = %username%@ourdomainhere.com Just so i under stand i can use the variable %username% i don't have to put the actual username?
   
4. Are you also using the the other reg keys i mention in my post? or just those two?
   

Edited December 7, 2021 by AlteredAdmin

[Boredguy]

the additional values updated OneDrive so it put the e-mail address into the box automatically and supressed the messages. If your e-mail addresses start with the normal network username, the %username% variable will automatically be replaced with the correct value when it runs

[AlteredAdmin]

the additional values updated OneDrive so it put the e-mail address into the box automatically and supressed the messages. If your e-mail addresses start with the normal network username, the %username% variable will automatically be replaced with the correct value when it runs

 

Ahh that would not work in our case. as it would return a different value than what is the Main email is from Microsoft.

[Chuckster]

We have the following Registry settings applied via GPP for users when they logon to stations and OneDrive is silently logging them in to OneDrive on Demand (other than when it decides to update)

 

HK_CU\Software\Microsoft\OneDrive\

EnableADAL = 1

ClientEverSignedIn = 0

SilentBusinessConfigCompleted = 0

FirstDeleteDialogsShown = 1

 

HK_CU\Software\Microsoft\OneDrive\Accounts\Business1\

FirstRunSignInOrigin = 0

UserEmail = %username%@ourdomainhere.com

FirstRun = 0

 

You, sir, are an absolute legend! Just applied these settings earlier and now my OneDrive account automatically signs users in, whereas before it was a manual process on every login.

[AlteredAdmin]

You, sir, are an absolute legend! Just applied these settings earlier and now my OneDrive account automatically signs users in, whereas before it was a manual process on every login.

 

How did you hand the %username% ? as our emails are different than our usernames.

 

For example:

Username: jdoe

Email: [email protected]

[AlteredAdmin]

the additional values updated OneDrive so it put the e-mail address into the box automatically and supressed the messages. If your e-mail addresses start with the normal network username, the %username% variable will automatically be replaced with the correct value when it runs

 

Wait i re-read what you said.

 

are you saying since our emails are different that it will automatically change?

 

For example:

Username: jdoe

Email: [email protected]

[AlteredAdmin]

SOLVED:Because i was setting SilentAccountConfig via SCCM Baseline. SCCM Baselines default to QWORD but the Value needs to be reg_dword, I had to check the box "create the registry value as a reg_dword data type if remediated for non compliant rules"

[Boredguy]

Wait i re-read what you said.

 

are you saying since our emails are different that it will automatically change?

 

For example:

Username: jdoe

Email: [email protected]

 

Our username and start of e-mail address are the same (since it makes logical sense for users to sign in to the computers with the same structure as signing in to Office 365)

 

If your e-mail address has a different name syntax such as forename.surname then it's harder since there is not a variable in Group Policy Processing that matches it.

 

But glad you got it sorted and happy that the values helped anyone else with automating the logon

[petben]

I have set the OneDrive GPO - Silently sign in users to the OneDrive sync app with their Windows credentials.

 

Silent sign in seems to be erratic, sometimes it works but sometimes we get the grey OneDrive cloud, sometimes the blue cloud but a red line through it. Profile deletion usually works, but that's not a fix for 100's of computers and 1000s of users. There's a load of stuff on Edugeek including this post about various reg keys but maybe in 2023 things have moved on. Has anyone got any advise please?

 

Thanks

[psydii]

Everything works best if you are on the equivalent of current branch for everything ('Office', Windows, OneDrive) and you don't have roaming profiles set up.

 

Anecdotally, the upgrade process cleans up the users' registry quite effectively. But if this doesn't sort it out, we wipe and reload the PC.

[PeterH]

I have set the OneDrive GPO - Silently sign in users to the OneDrive sync app with their Windows credentials.

 

Silent sign in seems to be erratic, sometimes it works but sometimes we get the grey OneDrive cloud, sometimes the blue cloud but a red line through it. Profile deletion usually works, but that's not a fix for 100's of computers and 1000s of users. There's a load of stuff on Edugeek including this post about various reg keys but maybe in 2023 things have moved on. Has anyone got any advise please?

 

Thanks

 

Try this powershell in a login script or a shortcut and see if it helps. We used it last year when we had lots of problems with OneDrive not signing in after switching tenants on Office 365. Obv test carefully in your environment.

 

Remove-Item Registry::HKEY_CURRENT_USER\Software\Microsoft\OneDrive -Recurse -Force
New-ItemProperty -Path "HKCU:\Software\Microsoft\OneDrive" -Name "EnableADAL" -PropertyType "DWORD" -Value "1"

[petben]

Thanks Peter, worth a test for sure. So now u have stability do u set any reg keys or just the single GPO to auto sign into OneDrive? Can u say that u have 100% Reliability with the auto sign in?

 

I’m setting files on demand and folder redirection via an environment variable but nothing else really. Seems so simple but erratic is the worse. Are u very strict on profile deletion?

[petben]

I am finding with some students:

 

- They definitely have and use a OneDrive account connected to their [email protected]

- They log in

- Edge gets logged into their account automatically (set via GPO)

- OneDrive is in the taskbar but is a grey cloud, if clicked it prompts to setup OneDrive

- If I go through the setup (entering their UN and PW and a few misc questions) it does setup

 

A similar student sat next to them OneDrive is auto signed in.

 

Can anyone advise a plan?

 

Thanks

[Olliedawg]

Resurrecting this thread - having the same problem. I have the GPO set, however it seems to be sporadic on when it decides to sign in. I have Edge/Teams auto signing in fine for staff and students.. Just onedrive which is an issue. As above, if a user clicks on the grey cloud in the taskbar, they are prompted to setup & this does work

 

[Dom_]

Resurrecting this thread - having the same problem. I have the GPO set, however it seems to be sporadic on when it decides to sign in. I have Edge/Teams auto signing in fine for staff and students.. Just onedrive which is an issue. As above, if a user clicks on the grey cloud in the taskbar, they are prompted to setup & this does work

 

[ATTACH=CONFIG]70487[/ATTACH]

 

 

Here's what I use - you need to add your tenant ID which you can get from the azure portal (under properties).