OneDrive Disable / Hide in Windows 10

OneDrive, if you’re not using it, it’s just another annoying thing in Windows 10.  If you’re able to use it, awesome.  But for those environments that want it gone, here is how I’ve removed it from our environment.  I’m using several methods to attack this thing to drive it into submission.

Update – 9/19/16 – With 1607, the Group Policy has improved, and this can be basically all done using the updated ADMX files for 1607. – Same policy shown in #2

1. OSD Steps
2. Group Policy
3. AppLocker

So, Let me break this down:

1. OSD (3 Steps) – Scripts available Here
   1. Tweak – Remove OneDrive ShellFolder (Command Line Step)
      REG ADD “HKCR\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder” /V Attributes /T REG_DWORD /D 4035969101 /F
      
   2. Tweak – Delete OneDriveSetup registry Key (Command Line Step)
      OneDriveRemove\DeleteOneDriveSetup-DefaultUser-RegisteryRun.cmd
      
      Batch File Contents: (mounts Default user Profile, delete the run registry key for OneDrive)
      reg.exe load HKEY_LOCAL_MACHINE\defuser c:\users\default\ntuser.dat
      reg.exe delete HKEY_LOCAL_MACHINE\defuser\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v OneDriveSetup /f
      reg.exe unload HKEY_LOCAL_MACHINE\defuser
      
   3. Tweak – Remove OneDrive App (Command Line Step) – 9/19/16 – Edit, this step is now failing in 1511 & 1607, I’ve set to Continue on Error for now.
      %SystemRoot%\SysWOW64\OneDriveSetup.exe /uninstall
      
2. Group Policy (Make sure you have the latest 1511 ADMX files
   1. Machine Policy \ Administrative Templates\Windows Components\OneDrive
      Prevent the usage of OneDrive for file storage = Enabled
      
3. AppLocker (Add to your already implemented AppLocker configuration, not covering that here)
   1. Deny ONEDRIVESETUP.EXE, in WINDOWS LIVE, from O=MICROSOFT CORPORATION, L=REDMOND, S=WASHINGTON, C=US
      1. Create New EXE Rule, Choose Deny
         
      2. Choose Publisher:
         
      3. Browse to c:\Windows\SysWOW64 and choose OneDriveSetup.exe
         
      4. Change the Slider to File Name, so it will block any version of that file.
         
      5. Leave the Exceptions default (Blank)
         
      6. Add Description if you like
         
      7. Click Create
         

After implementing these 3 processes, OneDrive is no longer showing up in our environment.