[21h1] Keeping OneDrive while blocking C Drive

[Tefters]

13 minutes ago, speakercon said:

You can just remove the folders by removing them from the registry, I remember trying this a couple of years ago but I seem to remember it causing some other unintended issue but I'm afraid I can't remember what it was.

 

For example, videos:

 

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}]

 

I guess MS is thinking is the music and video folders will be containing loads of large media files that they don't want people to sync to OneDrive, but obviously that doesn't work in an education environment, we can't have users saving things locally. What with streaming platforms how many avarage users actually have folders of music and videos on their computer in this day and age.

 

Known folders aren’t really needed anymore are they, just a simple OneDrive folder would suffice, they're just inherited from the past.

 

Aye your right, no-one uses them but there is always that 1 user that might accidentally save something there and then 🤦

 

I tried removing both of them via the reg keys and using the HiddenByDefault trick but didn't get any luck so your default redirect turned out to be the better approach in my opinion, once I saw it in action.

[DavR]

2 hours ago, Tefters said:

Good shout, didn't think about tricking it like that.

 

I'm more annoyed at Microsoft for supporting Desktop, Documents and Pictures via the Known Folders OneDrive GPO but completely ignoring Videos and Music, even though they are classed as default user folders on a profile creation.

When you run the same OneDrive client outside of GPO management, it sees and can sync the Videos and Music folders so it's only in the GPO managed world they decided to ignore it! 🤬

 

I think I'm going to go down the route suggested by @speakercon which is direct the Music and Video folders to the default profile equivalents, tested it last night and it worked well, the user just goes to a blank directory and then cannot save or create anything in those folders which will then force the user down the mindset of having to use the documents redirect.

 

Yeah, it is a nuisance that known folders only includes some, not all, known folders. At a guess, maybe they excluded Music and Video from GPO options as it might lead to a very large amount of data syncing, and crippling networks, as per @speakercon's comment. At a less charitable guess, they only bothered doing half the job! 

 

 

[Tefters]

So a couple of days later and a lot of F'ing and Jeff'ing I'm losing the will to live and after some assistance.

 

I have setup 5 GPO's relating to both OneDrive and Storage Sense. 1 GPO is for OneDrive user settings, 2 GPO's are for OneDrive machine settings (one with KFR and one without), and finally 2 GPO's relating to Storage Sense and deletion of cloud cache after X days (1 day for students, 7 days for staff) so I don't end up with C drives full of OneDrive local file caches.

 

I can't get OneDrive to work on my current Windows 10 image on the estate at all. Downloaded and installed the latest OneDriveSetup.exe in normal mode and /allusers machine-wide mode but the OneDrive.exe process just launches and disappears again instantly. Anyways I can't be bothered with that at the moment...

 

Looking at a new Windows 11 image I currently have an SCCM task sequence simply deploying Windows 11 and running "OneDriveSetup.exe /allusers" from C:\Windows\System32 for basic testing purposes, this works fine but with a caveat...

 

The issue I have is with the first ever logon of any profile after the build, as part of the GPO's I have OneDrive set to auto-start and auto-signin. If the first logon is via a student, they do not have MFA, OneDrive auto starts and then closes and re-opens, looking at logs this will be the OneDrive auto updating which is fine however it does not automatically login and after waiting 2 to 3 minutes I end up giving up and logging off and on again for a second time and the client auto loads and signs in as expected. Any subsequent user that logs on does not have this issue and OneDrive just auto loads and signs in.

 

Anyone else seen or experienced this and how do you get around it?

 

For my staff this will not be a big deal as they will need to manually sign in due to MFA so the auto sign in wont work but for students the first student to ever logon to a newly built computer would need to log off and on a second time or manually login to OneDrive which could be a little problematic.

 

Edited June 11, 2025 by Tefters

[DavR]

Weird, not a problem I've seen. The starting, closing, updating and reopening I see all the time on new builds, but SSO has worked all the time for us. What state is SSO in otherwise for you guys, can you open the OneDrive website per student successfully without any extra prompts? 

 

I assume when you say you're doing OneDriveSetup.exe /AllUsers, that this is a) a fresh version downloaded from Microsoft, and not a pre-existing version somewhere, and b) all setups etc are completed before you're attempting the Student testing. 

 

FWIW, we didn't use Storage Sense or anything like that to manage our disk space, so maybe you could disable that for testing. Never had a problem with disks filling up, we're using the storage restrictions from within OneDrive policies, but depends how big your OneDrive's are I suppose. 

[DavR]

I wonder if it's a case of having to be patient - sometimes OneDrive in the background could be taking longer than you think.

 

As a test, how about a fresh PC, do the first student logon, and then leave it for half an hour, see if it takes or not?

[Tefters]

OneDrive is user application by default ( installs the local app data), but you can install it in machine mode nowadays via the /allusers switch.

 

When a user logs on to a pc for the first time (per user) the OS runs OneDriveSetup.exe from c:\windows\system32 and installs OneDrive to the users local Appdata.

 

If you run OneDriveSetup.exe via command line with /allusers it installs a machine version into program files and runs it from there which is designed better for multi user machines aka school labs etc... You can do this at any time and it will convert user profiles already on the machine to use this instead of local Appdata and new user profiles moving forward so I run this during the end of the task sequence like a normal app installation.

 

SSO works for everything as a student including OneDrive but only for OneDrive it only works on the second logon if you were the first person to ever login.

If you are the second person to ever use that computer and it's your first logon to that pc the OneDrive SSO works so its something strange with the first ever profile logon on a machine.

 

Now for staff SSO does technically work but when I say it doesn't is because with MFA it fills in all their details etc... but can't do the final bit of the login due to needing the MFA code/authentication so staff have to manually click sign in for apps, then click ok as the login is auto populated, it doesn't ask for password as this is passed from SSO but they then hit the MFA code request and have to complete that on their mobile.

I'm not bothered about the staff as this is expected behaviour due to MFA.

 

It's this first profile login issue on a newly built machine if you were a student that's the issue and it will only affect the first ever student that logs on not the following ones.

 

I might try and script in a windows login to a local user account during the end of the task sequence and then do a restart a minute or 2 later if that's possible but just seems like an odd issue to have come up.

 

The reason this is problematic is because I was hoping to do known folder redirection for everyone and if OneDrive does not auto-load / login for the first pc profile login then that student could end up saving to the documents folder on the C drive without OneDrive loaded and then we have local files on a machine.

[synaesthesia]

You can hide those known folders using Intune or by invoking the WMI gods; unfortunately not via plain registry or GPO. Doing so removes all local storage, and you can do it quite easily in that manner whilst still allowing Onedrive to work. I did previously have it working with known folder move prior to becoming a Google school

 

I was trying to achieve the same with Google Drive FS, but alas it stopped that working as well  Trying to avoid folder redirection as we don't want to have anything reliant on a server, so having to just make do with funky logon permissions and hoping they're consistent enough to be feasible.

[Tefters]

54 minutes ago, synaesthesia said:

You can hide those known folders using Intune or by invoking the WMI gods; unfortunately not via plain registry or GPO. Doing so removes all local storage, and you can do it quite easily in that manner whilst still allowing Onedrive to work. I did previously have it working with known folder move prior to becoming a Google school

 

I was trying to achieve the same with Google Drive FS, but alas it stopped that working as well  Trying to avoid folder redirection as we don't want to have anything reliant on a server, so having to just make do with funky logon permissions and hoping they're consistent enough to be feasible.

 

Interesting, I haven't used Intune for our institute yet as we don't have any mobile Windows devices so I still live with GPO for on-prem stuff but might have to look into Intune then as I think its included in our M365 licensing package.

Edited June 11, 2025 by Tefters

[psydii]

On 04/06/2025 at 22:57, DavR said:

It's quite a while since I set up our OneDrive redirection, but, I used the environment variable method, as described here - https://community.spiceworks.com/t/onedrive-folder-redirection/1012141

 

You create a new environment variable that refers to your OneDrive location, and use GP to redirect My Documents to the %OneDriveLocation% variable. That achieved, you can then tell all your other folder redirects to follow the Documents folder. 

That's the old Microsoft way of doing it, if you fancy splunking through the github site that sites behind learn.microsoft.com you can find the original page.  We also set it up back in the 1709 era (so contemporaneously with that spiceworks post) and its been running like that just fine ever since.

[synaesthesia]

WMI field is

./Vendor/MSFT/SharedPC/RestrictLocalStorage

 

See https://petervanderwoude.nl/post/configuring-shared-pc-mode-with-onedrive-sync-enabled-and-configured/ for more details

[psydii]

13 minutes ago, synaesthesia said:

WMI field is

./Vendor/MSFT/SharedPC/RestrictLocalStorage

 

See https://petervanderwoude.nl/post/configuring-shared-pc-mode-with-onedrive-sync-enabled-and-configured/ for more details

It does sound like Tefters might have the sharedpc wmi setting applied (which blocks OneDrive client). I was poking around at somthing similar recently and there are also now example scripts on for this on learn.microsoft.com too. Configure a shared or guest Windows device | Microsoft Learn

[synaesthesia]

Ah indeed - looking further at it, onedrive works in the context of 365 apps or anything else with save to onedrive shortcuts, but it won't show in file explorer

[Tefters]

Ok so futher testing update from today:

 

I have 100% proven that the first-ever profile logon on a newly built Windows 11 machine will not auto-sign in however if you simply log off and log on again with the same account or a different it will.

If you logon with account A as the first ever account on a new build and it doesn't auto login and then log off and log on as account B for the first time on that machine it will auto-sign in, same thing if you were to log in again with account A so its definitely an initial OneDrive behaviour on a new OS install for the first ever profile logon.

 

After doing extensive testing to prove the above I built 2 test machines and logged on as local admin for the first ever profile logon.

Local admin does not have an Office 365 profile nor does it take GPO's but OneDrive did launch, update, close and then re-open on the task bar over the course of 2 minutes and then sat there loaded but disconnected with no profile, I didn't touch OneDrive or any settings simply just log on, wait 2 minutes and log off.

I then logged on a student A for the first time as that student and Windows went through the whole profile setup, hit the desktop and then waited 2 minutes for OneDrive to do its thing. Voula OneDrive appeared and auto-signed in with no issue. Tested with student B and voula, same thing.

 

Both these worked for their first profile logons on that machine because I logged on as another profile as the first ever PC profile logon. #FML

 

So with this all tested and proven now I need to find a way to either get around this somehow and trick OneDrive into loading in some fashion before a user ever logs on to a new built machine or log as a dummy local account I create in the image during a task sequence and then restart after 2 minutes?

 

Back to the drawing board!

 

 

Edited June 11, 2025 by Tefters

[speakercon]

It's a controversial way of doing it but 3rd party software such as cloud drive mapper can be less of a headache I've found. 

[Tefters]

1 hour ago, speakercon said:

It's a controversial way of doing it but 3rd party software such as cloud drive mapper can be less of a headache I've found. 

 

I'm just confused about how others are doing it then? I'm not doing anything special here and surely can't be the first implementing OneDrive with Known Folder redirection while expecting auto login to work on a fresh new install.

 

Edit - Hang on, hang on, hang on... I just went and looked up that Cloud Drive Mapper by IAM, that is exactly what is need 1000 times over! It even does SP document libraries.

Will be messing around with a trial tomorrow while looking into the OneDrive first login thing still but holy hell, can't believe I didn't hear of that before.

Edited June 11, 2025 by Tefters

[speakercon]

In theory I would rather not use CDM, and use the OneDrive client, but it doensn't seem to work well in a shared PC enviroment such as schools, for 1:1 devices its okay, but sync issues still happen in my experience.

 

I do feel it is pandering to the old 'we've always accessed files through mapped drives and will not have it any other way' bridage but it does work well and the new V2 lets you easily redirect all the know folders without a load of regedits.

 

And no sync issues to worry about.

 

 

[Tefters]

14 minutes ago, speakercon said:

In theory I would rather not use CDM, and use the OneDrive client, but it doensn't seem to work well in a shared PC enviroment such as schools, for 1:1 devices its okay, but sync issues still happen in my experience.

 

I do feel it is pandering to the old 'we've always accessed files through mapped drives and will not have it any other way' bridage but it does work well and the new V2 lets you easily redirect all the know folders without a load of regedits.

 

And no sync issues to worry about.

 

 

 

That's exactly the boat I am in now, and I just chatted with my techs about.

OneDrive is definitely the way forward instead of our file server home drives, we have already moved our shared drives to Sharepoint site libraries years ago, but the OneDrive client has these little issues I run into.

 

At the moment I had my end users running through the browser for the last 2 years when it comes to OneDrive and Sharepoint but its been painful for all and especially when on a home PC they can just link up to Office 365 and boom OneDrive client on their PC's etc... and then I have to explain the pain of shared computers and the fact they rotate around classrooms / work areas.

 

Do you run the OneDrive client as well or do you just use CDM on its own ?

Also how does CDM work with the likes of Mailmerges and collaboration of documents? What I mean by that is when you save a file to OneDrive or Sharepoint you get the auto save and multi-user collaboration features but not if you save to a local drive, how does that work with CDM if you save to the drive it provides?

 

The annoying part is that I am so close to just using the OneDrive client and having it work but this first ever logon on a new build computer would be a killer in IT suites without having my techs go round and log on to all new build PC's afterwards with local admin so the OneDrive client can do whatever it needs to do on the first profile login and then be ok for everyone else.

Edited June 12, 2025 by Tefters

[DavR]

Unless something changed in the recent version upgrade, Mail Merge doesn't work via CDM mapped drives, as it recognises that they're SharePoint underneath. This is one reason why I keep the OneDrive sync going, whilst also doing a mapped drive. 

 

Sidenote, but, @speakercon I didn't know there were folder redirection options in CDM now! Do you have any links to info? 

[Tefters]

9 minutes ago, DavR said:

Unless something changed in the recent version upgrade, Mail Merge doesn't work via CDM mapped drives, as it recognises that they're SharePoint underneath. This is one reason why I keep the OneDrive sync going, whilst also doing a mapped drive. 

 

Sidenote, but, @speakercon I didn't know there were folder redirection options in CDM now! Do you have any links to info? 

 

Folder redirection - Was having a read last night out of curiosity.

 

Also How to set-up Folder Redirection into OneDrive for Business : IAM Cloud Support and How to enable Folder Redirection with OneDrive — IAM Cloud

Edited June 12, 2025 by Tefters

[speakercon]

I only deploy CDM, the risk of files not syncing and then the profile getting deleted was too much of a concern. For example if a user logs off immediately after closing a file, not allowing it time to sync and then the profile getting removed.

 

V1 did not allow mail merge but V2 does now work with them.

 

Once you open an office document from a drive autosave is enabled by default and multiple people can work on the document (as long as your using 365 desktop apps).

 

My advice to users is to always use the web version and use the 'open in desktop app' option to open files, but (for now) the drives are still available if you must do it that way, and they will of course continue to do it that way until they don't have a choice.

 

@DavR & @Tefters you can set a folder redirection policy in the dashboard now to deploy as part of the licence key. Only caveat is if the drive doesn't map for whatever reason the folders stay pointing to the local profile - Creating a folder redirection policy

 

 

[Tefters]

While drinking a coffee and reading through all the OneDrive GPO's again in great detail I have spotted something:

 

Quote

This setting lets you redirect known folders to OneDrive without any user interaction. In sync app builds below 18.171.0823.0001, this setting only redirects empty known folders to OneDrive (or known folders already redirected to a different OneDrive account). In later builds, it redirects known folders that contain content and moves the content to OneDrive. We recommend using this setting together with "Prompt users to move Windows known folders to OneDrive." If moving the known folders silently does not succeed, users will be prompted to correct the error and continue.

 

So I'm now in the process of rebuilding a new test machine, going to logon as a test student for the first ever logon, expect OneDrive to not auto-sign in, create a document in the documents area and then log off and back in again to hopefully find OneDrive auto-signed in with known folder redirection and the local document synced to OneDrive. It does mean that the first ever person to logon to the new PC if they just created some work and saved it to the Documents or Desktop area that the file is locally stored on that machine until they logon again.

 

While still not perfect as it means for the first logon on all the computers in labs after I roll out Windows 11 students will either need to do 1 of a few scenarios:

• To see their documents and have folder redirection either click sign-in or log off and on again
• Just log on and create some work and save to documents (which will be local) and then hopefully they will log on again to this PC within say 14 days and next time they do the file will sync to OneDrive

Edited June 12, 2025 by Tefters

[DavR]

1 hour ago, speakercon said:

I only deploy CDM, the risk of files not syncing and then the profile getting deleted was too much of a concern. For example if a user logs off immediately after closing a file, not allowing it time to sync and then the profile getting removed.

 

V1 did not allow mail merge but V2 does now work with them.

 

Fair play. We've never had this happen with personal OneDrives, but it certainly did happen when I initially tried to access our Staff shared drive and others as a OneDrive synced folder, they were never the same on any two machines. CDM was purchased quite swiftly after I realised how badly the latter did not work.

 

Thanks for the tip re Mail Merges - looks like I can put those back onto my mapped drives, rather than cached in OneDrive, at last!

 

Interesting re CDM doing folder redirection. I'll not rush out and make any changes, but that's two more nails in the OneDrive sync tool's coffin you've handed me today  

[mavhc]

What version of OneDrive is deployed to your new image?

[Tefters]

It's the May25 ISO of Win11 24H2, which currently has version 23.081.0416.0001 included in the system32 folder and I am running the OneDriveSetup.exe /allusers from that but as mentioned before on logon it does launch this version and then immediately update and restart the OneDrive application because if I give it 2 minutes after the first ever logon and then check C:\Program Files\Microsoft OneDrive I see 2 folders, the version just mentioned and then a newer version which funnily enough is a higher number than what you can download from Microsoft if you browsed to their OneDrive download page but they do have a disclaimer on that saying this page and the download on it is not always as up-to-date as the built in updater that OneDrive itself uses.

 

Now I built a new machine this morning and logged in as a test student account, then went and made a coffee and stretched my legs (15 minutes) came back and OneDrive was there on the taskbar but not auto-signed in.

From my PC I UNC'd over and confirmed all the above regarding program files to make sure it was the machine install not the user install etc...

I then opened Notepad, facerolled my keyboard and saved to documents which is local due to OneDrive not being signed in aka no Known Folder Redirection as I was then going to test logging off and back on to see if OneDrive would then auto-sign in and sync the document but to my amazement OneDrive all of a sudden auto-signed in and sync'd the text file I just created after it saved to the documents folder. As it did this the Known Folder Redirection magically kicked in and the documents folder now pointed to OneDrive.

 

I am about to try and test this behaviour again with a fresh test build behind me and having someone else watch to make sure I am not going mad!

 

 

[DavR]

I don't know if it makes a difference, but I've never heard of updating the OneDrive client via C:\Windows\System32\OneDriveSetup.exe /allusers. I've always downloaded the latest version from the Microsoft page, and installed that via startup scripts using the /allusers /silent switches. 

 

Two thoughts - could that minor difference of source file be causing your issue?

 

And - Are you using the /silent switch on your installer? Could it be that OneDrive install isn't actually completing, and your first run that doesn't sign in properly is actually a repair?