Our organization is new to OneDrive and Sharepoint, having for years used an on premises file server for all our collaboration and storage. Over a period of 3 weeks we migrated all our separate shares to sharepoint sites, and experienced the following 2 main difficulties: 1) our large store of photos in the communications site refused to consistently display thumbnail icons or previews. 2) users who opened the same files were not warned of the fact that the first one was editing and were forced to fork their changes into a different file if they were lucky, otherwise Onedrive would simply give them a synchronization error.
We were researching a different issue when we stumbled on the reason in the event viewer. "Access to C:\Users\xxuserxx\AppData\Local\Microsoft\OneDrive\19.012.0121.0011\FileCoAuth.exe has been restricted by your Administrator by the default software restriction policy level."
OK, We have SRP in place and it's saved our bacon numerous times, but in the case of a misbehaved program (OneDrive in this case) we can add exception rules to allow it to launch out of the users profile. We've done it dozens of time and it works. (although I can't for the life of me understand why developers persist in behaving just like viruses and executing programs this way, shame!)
Well we added a special rule and, no difference. The above error message littered our event logs, and we noticed it was there seven or eight times every time office would open a file. We tried all sorts of angles on exception rule creation and no difference. (we did try turning off SRP and no error was produced -- not really an option for prime time though) Finally we tried executing FileCoAuth.exe from the run dialog. No error reported and windows allowed us to do it. We also noticed that once it was successfully run, both of the problems I listed at the beginng simply disappeared.
So then the thing was to put a workaround in place. We tried a login script to run the program but that produces the same error. In end we've settled on a powershell script invoked from the startup folder that waits for the presence of OneDrive and then runs FileCoAuth.exe. This works. But this is a bug someone should look at. SRP, also called Application Whitelisting, is an important defence measure. And Microsoft should make sure their corporate products are compatible with it.
