Silently configure OneDrive using Windows 10 or domain credentials

[Deleted]

Hi ,

In reference to :

(Preview) Silently configure OneDrive using Windows 10 or domain credentials  

https://support.office.com/en-us/article/Use-Group-Policy-to-control-OneDrive-sync-client-settings-0...

I have a few questions;

The article states that "This policy lets you configure the OneDrive sync client silently using the primary Windows account on Windows 10, and domain credentials on Windows 7 and later."

What is a primary windows account on windows 10? I have a Win 10 and i sign in using a domain account. 

I created the registries for EnableADAL and SilentAccountConfig , restarted the sync client and also the machine.

This does not sign me in to my account automatically. Is there something i am missing?

I noticed a few things after adding the registries;

1.Theres a new file added under C:\Users\username\AppData\Local\Microsoft\OneDrive\settings called PreSignInSettingsConfig.json

2..Everytime i launch the onedrive app and the sign in screen appears; it creates a new update file at:

C:\Users\username\AppData\Local\Microsoft\OneDrive\setup\logs and the contents of the file say its trying to refer to the .json file mentioned in 1.

I am not sure what i am doing wrong, any help would be appreaciated.

[#2]

Anyone know/think this setting will be the default in future versions once the setting is out of Preview? Just so we can plan abead. In general it feels like a good default option but some kind of failback to other setting if login fails.

[#3]

I would like to know this too. We don't have ADFS, will this work without it?

[#4]

Any idea when this will come out of preview?

[#5]

I was also having this problem and it sounds like my environment is similar to yours (ADFS and MFA) In addition to setting the GPOs you have set and setting the reg value "ClientEverSignedIn" to 0, I also had to set "SilentBusinessConfigCompleted" to 0.

Once that was done, it began to work when OneDrive is launched.

It's a requirement that all my users be logged into OneDrive whether they want to or not, so I've created another GPO to check if the user is configured and reset the above reg keys to 0 if they are not.

OneDrive creates a new key in the format of Business<digit> under "HKCU\Software\Microsoft\OneDrive\Accounts" for any business accounts that have been logged into OneDrive. Under that key, you can use "ConfiguredTenantID" to check that they're configured for your tenant and "UserFolder" to see where it is configured to sync to.

Also, if OneDrive does not start in the foreground, it will not configure using ADAL. The OneDrive startup reg key has the "/backgroud" parameter set, so my GPO checks to see if the user is configured and if they are not, it adds a RunOnce entry without the "/background" parameter.

It would seem HTM files are not allowed to be attached, so I've attached a screenshot of my GPO report.

The HTML can also be found here if you'd prefer that:
https://pastebin.com/1ebujuU5

[#6]

If this method auto signs the current window domain user into onedrive, can it be set to auto login to any office 365 deployed apps locally installed on the machine?   I'm using shared computer activation method for o365 deployment.  All domain users have o365 accounts, we are deploying o365 apps onto images for rollout throughout school district.  Once the user logs into the computer with their domain account, I'd like them to be able to launch any of the installed o365 apps and be auto logged in.  I'm wondering if some variation of this onedrive technique would work.  Right now users are still getting prompted to sign in to activate office, so it can pull a shared license key from o365.  

[#7]

I have not tried setting it up for other office apps.

From here:
https://support.office.com/en-us/article/How-modern-authentication-works-for-Office-2013-and-Office-...

It looks like it should be enabled in Office 2016 by default.

You may also want to look here:
https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso

As it explains some of the other pre-reqs for ADAL auth if you're syncing with on-prem.

[#8]

Have you found away around the users having to hit the login button? I am also stuck here.

[#9]

Does this method eliminate the need for user interaction or does the user still have to click something?

[#10]

We have been kicking the around for a couple weeks. We still have a lot of folks on Office 2013 and the old Groove client. We are looking to migrate them to 2016 and seamlessly move them over to OneDrive. We were seeing very inconsistent test results. After adding the ADAL and SilentAccountConfig keys some machines were switching over to OneDrive without prompting for login and others were prompting. Although we are using the current version from the Office portal it seems the version of OneDrive which initially comes down is a bit older. 17.3.6743.1212. I suppose if we were patient it would eventually update to a newer version but that isn't an option.

We are now getting consistent results if we run %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe, wait for it to finish, then launch OneDrive and it logs in with Modern Auth (No prompting)

Hope this helps. This thread was extremely helpful!

[#11]

I have almost all working on latest client 18.151.0729.0012 apart from the actual "Silently redirect Windows known folders to OneDrive"

I have it enabled with tenant ID & show notification YES, but instead this happening on the client I have "... a reminder notification will appear in the activity center until they move all known folders."

If I click Protect these folders it work fine, but I do NOT want my users to have any input!

Seb

edit

I see it now, it is VERSION number that needs to change!

Silently move Windows known folders to OneDrive

Use this policy with the sync client build 18.171.0823.0001 or later to move your users' known folders to OneDrive without user interaction. (You can choose to display a notification to users after their folders have been redirected.)

EDIT 2

That is NOT true at all, as I have it working even on current version fine following my own setup:

[#12]

Hi,

Did you have any problems installing the One Drive client on your windows 10 PC's? Mine looks to install and then just closes without the OneDrive client being available.

[#13]

Looks like you have a reg key thats blocking onedrive from launching it.

[#14]

The specific key is HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\OneDrive\DisableFileSyncNGSC = DWORD:1 

[#15]

Hello,

you need to run GPRESULT with admin rights. Launch a command prompt with administrator rights, and in the cmd window launch your GPRESULT command (including the option "/scope computer" if you only want to report on the GPO affecting the computer)

Michel

[#16]

@Oliver Roos 

in GPO explanation:

If you enable this setting, users who are signed in on the PC with the primary Windows account (the account used to join the PC to the domain) can set up the sync client without entering the credentials for the account. Users will still be shown One Drive Setup so they can select folders to sync and change the location of their One Drive folder.

So only admin, who have joined PC to domain can set up Onedrive silently???

[#17]

Does anybody know if we need an Azure AD Sync with an ADFS infrastructure or if Azure AD Sync with Password Sync will work as well?

[#18]

@Manuel_Martinez  either should work whether it's a federated domain or managed.   There are separate steps for federated vs managed, but the same process through azure ad connect hybrid setup wizard.

[#19]

@Jeremy Friesen In my Group Policy does not have the OneDriveGroupPolicy (Silently sign in users to the OneDrive sync app with their Windows credentials) like you've mentioned in the picture. I am using Windows Server 2012 R2. Below is the picture you can see it.

Would be appreciated if you could advise on that. Because I need the OneDrive to silently sign-in with Computer credential When the users logged in to the computer. 

[#20]

@maoneak 

You'll need to update your Onedrive Policies.  Here's a link with instructions.

Use OneDrive policies to control sync settings - SharePoint in Microsoft 365 | Microsoft Learn

[#21]

The only way around this is to set up conditional access policy to skip 2fa if you are at the office and only enforce 2fa from outside the office. thats what i had to do to get onedrive working