Files on Demand randomly downloading and filling hard drives

[Richard Duggan]

We have an Office 365 for Education tenant and have been migrating users from our file servers to OneDrive with Files On Demand. Recently we have been finding files and folders being downloaded even though our OneDrive default is set to "Save space and download files as you use them" via group policy. In a few instances we have had users come in to work to find "out of disk space" messages when they log in. If we right-click a folder and select "Free up space" the files return to placeholders temporarily, then start downloading again with SearchProtocolHost.exe listed under the file being downloaded in the OneDrive status box (see screen clip below). This is happening both with folders/files in users' individual storage and in shared storage in Office 365 groups. Some of our groups have very large amounts of data that exceed the capacity of their local hard drives, which is why we waited for Files on Demand before we started this migration. We can't continue until this is solved. We are running Windows 10 Version 1803 (Build 10.0.17134.228) and OneDrive 18.151.0729.0006. We have discovered that disabling and stopping the Windows Search service stops the download problem, but obviously this is not an acceptable solution.

I have searched in vain for another example of the problem. I'm now on my third round of tech support calls with Microsoft and have yet to find anyone who seems to be able to connect with the right group to resolve this issue. I'm not new at this and I'm stumped.

[#2]

Does this happen for only PDF files? I've never had issues with the search index forcing a download of "on demand" files, however I've seen other software causing issues (including some of the built-in Windows apps). You have an option to "block" such programs as detailed here: https://support.microsoft.com/en-us/help/4042378/windows-10-automatic-file-download-notifications

[#3]

Hi Vasil and thanks for responding.

No, it happens seemingly randomly and with all types of files. Here are two more examples:

I did find the article you mention, but there have been no notifications which could be clicked to initiate the block until I finally did see one yesterday. Unfortunately I was not fast enough to click it and it disappeared and did not remain in the notification area.

I think blocking SearchProtocolHost.exe from downloading files automatically without disabling the Windows Search service may be the key (at least temporarily) to an acceptable workaround, but I can't find a way to do that. This article:

https://www.winhelponline.com/blog/onedrive-demand-block-automatic-file-downloads/

details the registry key where blocked programs are listed:

HKEY_CURRENT_USER\Software\Policies\Microsoft\CloudFiles\BlockedApps

but our Windows 10 1803 installation doesn't even have the CloudFiles key, much less the BlockedApps key or any entries in it. If I could figure out how to define a value for SearchProtocolHost.exe (other than by clicking a notification that I have only seen pop up once for about a second) I think I might be on track to a solution.

[#4]

Any third party indexing tools or add-ons being used so the files might get modified?.

Have the modified (or Accessed) time been updated to the time when it got downloaded?

And you are sure that there is no Group policy that can affect this?

[#5]

Olav - thanks for the reply.

We are not using any third-party indexing tools and the files and their metadata are not being modified. The files are clearly being downloaded by SearchProtocolHost.exe, which is the Windows Search service, even though online-only files are not supposed to be indexed. As far as I can tell we have no group policy that is affecting this and we have non-domain-joined machines that are doing it as well which pretty much eliminates that possibility. We do have all of the machines managed through SCCM, but we aren't enforcing anything non-standard in terms of indexing or anything like that.

We are now finding this happening on Windows 1709 machines, too, so it's not just a recent development with rolling out 1803. I'm more suspicious that it's something in the latest binaries of OneDrive. With all of this experimentation I have discovered that Windows Search is tightly coupled to the Files on Demand function. If you disable Windows Search, the "Free up space" option will be greyed out in the menu unless you are clicking on a file or folder that has been made available locally. If Search is running, you can select "Free up space" from anywhere in the hierarchy and OneDrive/Windows will remove locally-stored copies from everywhere below that point.

I'm pretty frustrated as our whole Office 365 rollout strategy is based around this feature. I have tech support incidents in progress with both the OneDrive and Windows teams (who don't talk to each other!) and can't seem to get this escalated to someone who understands how this technology works better that I do!

[#6]

I have three customers with the same issue, and myself. One I found was a Dell optimization tool that had Antivirus built into it. Each time the antivirus touched the file on demand it would download it. I have a couple open tickets with MS, but nothing resolved yet. 

[#7]

Quite sure that the antivirus are not «files on demand» compatible. Quick out of my head I see 4 ways of fixing it. Number one and the best, use built in windows defender instead. Windows defender are now on of the best AV, had a bad rep for a while but totaly trustworthy know and free. Number 2, get a newer version of AV or another vendor. Number 3 exclude the path to the onedriver folders, this might be risky since the files will not be scanned regularary, but most AV would scan them while they are being downloaded and for sure when been runned. Number 4, select only necessary folders to be synced and keep everything downloaded

[#8]

One other tip if it’s not AV related, clear upload cache. For Office you might need to manually delete the folder with the cache. Onedrive try tips 8 and lastly 9 in this post https://www.windowscentral.com/9-tips-help-you-fix-onedrive-sync-problems-windows-10

[#9]

We are using only Windows Defender for antivirus. The application that is downloading the files in our case is SearchProtocolHost.exe, which is the Windows Search service. So for I have not found a way to tell Windows Search not to try to index the files in OneDrive. The documentation actually specifically states that for FOD files only the filename will be indexed.

I have tickets open with both the OneDrive and Windows teams and have given them extensive log files and screen captures and they haven't been able to come up with an answer. I am waiting to try out Windows 1809 to see if the new features including Storage Sense have any impact on the problem.

What's odd is this seems to happen to specific users, not computers. I have five machines that I use and once it started happening it started happening on all of them. Other users that have had it happen have the same experience. But we have dozens of users with identical hardware and software configurations for whom it is not happening.

[#10]

Richard, replay was more aimed at Steve ;-). But, the last one with clearing cache might be more for you? Make sure everything in there is clean and see if it change the experience.

[#11]

@Richard DugganDid you ever solve this issue or get a response from microsoft? I'm seeing the same issue with searchprotocolhost.exe downloading files.

[#12]

@_kurt_I've paused search indexing for the time being.

[#13]

@_kurt_ The problem went away when we migrated to a newer version of Win 10. I believe the problem emerged in the switch from 1709 to 1803 and went away with 1809. We're now running 1909 in most places and not seeing the problem. The full Storage Sense integration that comes with these newer versions is also very valuable and important for other reasons, but I think the disconnect between the hooks for it in the client and the OS were the source of the problem.

[#14]

Hello Richard, I still see some clients with this issue that the searchprotocolhost.exe ist downloading files via OneDrive connector. In this case today it was possible to solve it with reconfigure the sync folders.
Current version 22.176.0821.0002