This message was deleted.
# _generals
Slackbot
08/03/2021, 5:34 PMThis message was deleted.
d
Deyda
08/03/2021, 5:35 PMUse appmasking to stop the ex's!
b
Barry Browne
08/03/2021, 5:36 PMThat just hides it. What we are seeing in our non persistent Citrix sessions, that is is jacking a lot of CPU when a new user logs in, and the One Drive installer kicks off.
j
James Rankin
08/03/2021, 5:39 PMRemove it from the default profile?
b
Barry Browne
08/03/2021, 5:40 PMDo you mean delete the install file from the default profile?
j
James Rankin
08/03/2021, 5:40 PMThere's an autorun it sticks in the default profile Registry hives - or at least it used to
b
Barry Browne
08/03/2021, 5:41 PMahhhh. Off we go to the registry...
j
James Rankin
08/03/2021, 5:42 PMI think it was in Software\Microsoft\Windows\CurrentVersion\RunOnce (as I said, could have changed or moved)
b
Barry Browne
08/03/2021, 5:45 PMThanks James..
Barry Browne
08/03/2021, 5:46 PMLooks like it has moved elsewhere in 21H1
🤦♂️ 1
Barry Browne
08/03/2021, 5:55 PMIt is just in /run now....
j
James Rankin
08/03/2021, 5:56 PMIn the default profile?
b
Barry Browne
08/03/2021, 5:57 PMYessir.
Barry Browne
08/03/2021, 5:57 PMSoftware\Microsoft\Windows\CurrentVersion\Run
j
James Rankin
08/03/2021, 5:58 PM🔥
n
Nathan Sperry
08/03/2021, 5:59 PMAs mentioned previously just hide/delete the OneDriveSetup.exe in c:\windows\system32 or syswow64. And yes it’s in the default user profile
Nathan Sperry
08/03/2021, 5:59 PMI mask that file with FSLogix
Nathan Sperry
08/03/2021, 6:01 PMYou can also hide that registry value using FSLogix. The other thing you can do is modify the default user profile, personally I prefer the masking route
Nathan Sperry
08/03/2021, 6:02 PMOh and none of this stops a user downloading and installing OneDrive themselves
b
Barry Browne
08/03/2021, 6:14 PMWhat a mess..
n
Nathan Sperry
08/03/2021, 6:40 PMAnd if you really don’t want OneDrive used, then use AppLocker
b
Barry Browne
08/03/2021, 6:45 PMIIRC you need Win10 Enterprise for AppLocker. We are only running Pro.
n
Nathan Sperry
08/03/2021, 6:50 PMNot quite true. You can only manage AppLocker with GPO using the Enterprise version but it works and is supported in the Pro version but you have to manage it using other means I.e. CSP - but yep makes it more difficult
j
James Rankin
08/03/2021, 6:51 PMRoll out the SRPs!!! You may laugh but the customer I am currently screaming at use SRPs still
n
Nathan Sperry
08/03/2021, 6:52 PMYep works a treat too, though the last time I used SRP was to block login scripts defined in the users AD properties
Nathan Sperry
08/03/2021, 6:54 PMGoing back to OneDrive, you can still do some masking work to stop users downloading and installing it, but does have some flaws. Trying to stop all this stuff is fighting a losing battle really, cos you’ll find one why to stop it then next month MS will change the goal posts
c
Chai
08/04/2021, 7:04 PMonedrive exists in system32 and in user profile. This is the batch script I use to remove onedrive:
takeown /F c:\windows\syswow64\onedrive*
cacls c:\windows\syswow64\onedrive* /e /p everyone:F
taskkill /f /im onedrive*
del /q c:\windows\syswow64\onedrive*
rmdir /s /q %localappdata%\microsoft\onedrive
del /q c:\windows\syswow64\onedrive*
Check if this helps...
3 Views