Onedrive for Business Client Sycn App - Updating Offline

[shocko]

I'm using OneDrive for business client sync app in a very tightly controlled environment. We have the app deployed machine wide (per machine as opposed to per user). Our security teams do not want to allow the update scheduled task to access the internet locations required to update the app. As such, they have asked me to come up with a solution to keep it up to date offline.

I have MECM in my environment and all my machines have line of sight of our corporate network (either on-prem or via VPN).

What are my options here? As far as I can see it’s as follows:

1. Scripted task in MECM to run a scripted to update form a UNC/HTTP location hosted by us
2. We keep this location up to date with the versions of OneDrive we wish to deploy
3. We run OneDriveSetup.exe /update to patch

Any alternatives/ideas!?

[#2]

Hi @shocko,

Your plan to use a MECM scripted task to run OneDriveSetup.exe /update from a UNC/HTTP location hosted by you is a good solution.

This solution will ensure that all of your managed devices are always running the latest version of the OneDrive for Business client sync app, even if they do not have internet access.

Here are some alternatives (or other ideas) you can try to use:

• Use a third-party patch management solution. There are a number of third-party patch management solutions that can be used to update the OneDrive for Business client sync app offline. These solutions typically work by downloading the latest updates from the Microsoft servers and then caching them on a local server. The patch management solution can then be used to distribute the updates to managed devices offline.
  
  
• Use a WSUS server. If you are using WSUS to manage other software updates on your network, you can also use it to manage OneDrive for Business updates. To do this, you will need to add the OneDrive for Business updates to your WSUS catalog. Once the updates have been added to the catalog, you can approve them for deployment to your managed devices. WSUS will then download the updates and cache them on your WSUS server. You can then use WSUS to distribute the updates to managed devices offline.
  
  
• Use a manual update process. If you only have a small number of managed devices, you can manually update the OneDrive for Business client sync app on each device. To do this, you will need to download the latest version of the installer file from the Microsoft Download Center and then run the installer file on each device.

If you have a large number of managed devices or if you need to automate the update process, then I recommend using a MECM scripted task or a third-party patch management solution.

If you only have a small number of managed devices or if you do not need to automate the update process, then you can manually update the OneDrive for Business client sync app on each device.

Please click Mark as Best Response & Like if my post helped you to solve your issue.
This will help others to find the correct solution easily. It also closes the item.

If the post was useful in other ways, please consider giving it Like.

Kindest regards,

Leon Pavesic

[#3]

@shocko This is doomed to failure like all attempts to second-guess cloud-sync services.

It's not just a matter of keeping files up to date, but all the sharing permissions, comments and other service states that connect those files.

I'm all for security, but this request will cripple how the Microsoft 365 environment works.

They either need to come up with a total on-prem solution or even send everyone back to the 20th century to a file-server.

[#4]

I'm not sure I understand Mike? OneDrive itself has internet access as it runs under the user context and can use our corporate Web proxy with Auth and inspection etc. It's the update process our security teams are concered with as tURIs used are very generic.

[#5]

I don't see Onedrive listed as aproduct in WSUS. Can you elaborate please on how to achieve this with Onedrive?