Share via

How to find out One Drive client install/uninstall information

SAMUEL VALAPARLA 126 Reputation points
2023-01-24T18:12:28.4566667+00:00

Hi,

An important user in my org'n had lost his One Drive Client which wasn't supposed to happen and we're trying to trace possible triggers etc. The last sync for One Drive has been found on 20th Jan and hence its assumed that the removal incident took place around that time As we use SCCM for software deployment initial efforts started with that. I've checked all status message for a specified computer and couldn't find any specific records indicating removal for the relevant date range. Have also checked the SCCM client logs for any uninstall activity in this date range and couldn't find any. Now we don't have direct access to the affected computer but can map drives, map event viewer and run scripts remotely to fetch any information. In the worst case we can indeed obtain remote control of the computer.

Since One Drive client gets installed in local user context (and I requested to be corrected here if different) what are the recommended logs, sources, paths, I could look into on the affected computer to find any information to trace the relevant information for the One Drive client removal?

Further attempts to analyse..

Trying to run the below script remotely on the affected computer.

Get-ChildItem -Path HKLM:Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall, HKCU:Software\Microsoft\Windows\CurrentVersion\Uninstall, HKLM:Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall | Get-ItemProperty | Sort-Object -Property DisplayName | Select-Object -Property DisplayName, DisplayVersion, InstallLocation, InstallDate | where {$_.DisplayName -eq 'Microsoft OneDrive'}

Also tried to check the below path on the affected user computer but couldn't find any relevant logs for uninstall of One Drive client

C:\Users\UserNam\AppData\Local\Microsoft\OneDrive\setup\logs

Thanks in advance..

Microsoft 365
Microsoft 365
Formerly Office 365, is a line of subscription services offered by Microsoft which adds to and includes the Microsoft Office product line.
4,032 questions
OneDrive
OneDrive
A Microsoft file hosting and synchronization service.
890 questions
Microsoft Configuration Manager
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Garth Jones 1,656 Reputation points MVP
    2023-01-24T19:44:56.3766667+00:00

    I would install One Drive on your (as low rights user) computer and determine if an event viewer entry or logging is made. Then I would uninstall it and review both the event viewer or logging to see what is done. From this info, you can determine what happen, if anything. Based on this you can review the same details on the other computer and give more details.

    0 comments