OneDrive Standalone Update Task gets created for each user Windows 10 1909 Enterprise

Michael Pfister
Michael Pfister used Ask the Experts™
on
After installing Windows 10 1909 Enterprise from scratch or upgrading from Windows 10 1803:
Windows 10 1909 creates a scheduled task "OneDrive Standalone Update Task-S-1-5-21.." for each and every user logging on (runs OneDriveStandaloneUpdate.exe for each user).

This is an Enterprise Environment and  OneDrive is not used at all.
Anyone knows a way to preven this?

OneDrive itself is disabled by GPO.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018

Commented:
I don't wknow whether these tasks can be prevented, but as for deleting them, I'd use a powershell startup script with this line:
Get-ScheduledTask | where TaskName -like "OneDrive Standalone Update Task*" | Unregister-ScheduledTask -confirm:$false

Open in new window

Hardware Tester and Debugger
Commented:
Hi there! :)

Just to add on, do a full anti-virus scan. If it isn't a malware, it's probably buggy.

Some malware camouflages itself as OneDriveStandaloneUpdater.exe, particularly when located in the C:\Windows or C:\Windows\System32 folder, for example Trojan.Gen.2 (detected by Symantec), and Trojan-Dropper.Win32.Agent.bjtupu (detected by Kaspersky). Therefore, you should check the OneDriveStandaloneUpdater.exe process on your PC to see if it is a threat.

Do check again if the new setting is in place, it can also be found under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\OneDrive

Since you said it is enabled, the GPO enabled should be under HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\OneDrive
@McKnife: Good idea to do this as a startup script.
Still looking for a way to prevent it …

@Noah: GPO gets applied and its no malware. MS just seems to be very creative in advertising OneDrive...
Probably found it:

A registry key is present in the default profile under Software\Microsoft\Windows\CurrentVersion\Run  -> OneDriveSetup

My first test after removing this specific entry was successful. The scheduled task wasn't created anymore for a new user...
Distinguished Expert 2018

Commented:
Say, what registry key is that, Computer\HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run ?
No OneDriveSetup present here, but the tasks are there.
Its not under HKU\.DEFAULT but in the default users profile that gets copied during the first log on.
Now trying this batch in my task sequence:

reg load HKLM\DEFAULT_USER "C:\Users\Default\NTUSER.DAT"
reg delete "HKLM\DEFAULT_USER\Software\Microsoft\Windows\CurrentVersion\Run" /v OneDriveSetup /f 
reg unload HKLM\DEFAULT_USER

Open in new window

Worked when I tested it manually...
Distinguished Expert 2018

Commented:
Thanks, yes, that one is present here, too.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial