Loading story…
Microsoft confirmed that a beta OneDrive Photos app was pushed through the preinstalled OneDrive sync client to more Windows 11 systems than intended, including enterprise devices where the app reportedly does not work. The rollout triggered complaints because the app appeared unexpectedly, could surface local and cloud photos, and currently cannot be removed on its own; administrators must uninstall OneDrive entirely to remove it. Microsoft said the deployment was meant for consumer devices, acknowledged the enterprise rollout was accidental, and said it is working on a fix and plans to allow separate removal later.
The company also sought to address privacy concerns around the app’s AI-powered People feature, saying it is off by default, only processes photos stored in OneDrive rather than PC-only images, and does not train AI models on users’ faces. On r/sysadmin, administrators reported the app appearing on Intune-managed environments without clear notice in the admin center, and some shared PowerShell detection and remediation scripts to remove it from affected systems while preserving the OneDrive client.
# Admins reported using Intune detection/remediation PowerShell scripts
# to remove OneDrive Photos from affected enterprise devices.
See real exploitation activity before you spend the cycle.
6 events from the most recent confirmed update back to the earliest known activity.
According to Windows Latest, the OneDrive Photos app started showing up on some consumer Windows 11 systems around August 1, 2026, delivered through the pre-installed OneDrive sync client.
The most recent Windows update on one observed affected production PC was the July 2026 Patch Tuesday release, which Windows Latest said was issued on July 14, 2026.
Windows Latest reported that the new OneDrive Photos experience had been seen earlier in 2026 on Windows Insider systems and was still in beta at the time of reporting.
A Reddit user on r/sysadmin said the app had appeared in at least one contractor-managed company environment and published GitHub-hosted Intune detection and remediation PowerShell scripts to remove it. The post highlighted the lack of a normal uninstall path because the app was tied to the OneDrive sync client.
Microsoft told Windows Latest that it accidentally shipped the beta OneDrive Photos app more broadly than intended, including to enterprise PCs where it was not meant to be deployed, and said it was working to fix the issue. The company also acknowledged that users currently must uninstall OneDrive entirely to remove the app.
Microsoft confirmed that it force-installed the new OneDrive Photos app on Windows 11 PCs and said the AI-powered People feature is off by default, processes only photos stored in OneDrive, and does not train AI models on users’ faces. The company also said the app could not yet be removed separately from OneDrive but that an update was planned.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcewindowslatest.com
Open sourcewindowslatest.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has introduced a new Windows 11 policy that lets IT administrators silently uninstall the **Microsoft Copilot** app from managed enterprise devices. The setting, exposed as `RemoveMicrosoftCopilotApp`, became generally available with the April 2026 Patch Tuesday updates and is supported on Windows 11 version `25H2` and later builds including `KB5083769`. Microsoft says the policy can be deployed through **Group Policy**, **Policy CSP**, **Microsoft Intune**, and **System Center Configuration Manager**, giving organizations centralized control over Copilot on **Pro, Enterprise, Education, and IoT Enterprise** systems. The removal applies only under specific conditions: **Microsoft 365 Copilot** must also be installed, the Copilot app must not have been manually installed by the user, and it must not have been launched in the previous 28 days. Microsoft described the uninstall as non-disruptive and said users can reinstall the app later, but the action is one-time only, meaning organizations that want to block reinstallation must use additional controls such as **AppLocker**, **Windows Defender Application Control**, or Intune uninstall profiles. The change follows broader adjustments to Microsoft's Copilot rollout as enterprise customers push for tighter control over bundled AI features.
Jun 29, 2026
Microsoft confirmed an incident affecting search functionality across several Microsoft 365 services, including **Outlook on the web**, **Outlook desktop**, **SharePoint Online**, and **OneDrive**. The company said a recent deployment introduced a resource-utilization inefficiency on affected infrastructure, causing some users to experience degraded service. Microsoft tracked the issue as **`MO1456424`** in the Microsoft 365 Admin Center and said it developed and deployed a fix to reduce resource pressure and restore normal operation. User reports aligned with Microsoft's notice, with administrators describing failures opening SharePoint and OneDrive files, intermittent access to some SharePoint resources, Outlook connectivity issues, and related errors involving Copilot and slow Entra Conditional Access behavior. Reports suggested the disruption was partial rather than global, with symptoms concentrated in some environments and regions, including anecdotal reports from the Central and East US, while other users said their tenants were unaffected.
Aug 18, 2026
Microsoft released an out-of-band Windows 11 update, **KB5086672**, to fix a widespread installation failure affecting versions **25H2** and **24H2** after the March preview update **KB5079391** triggered repeated setup errors. Affected systems entered a loop of failed update attempts and reported error code `0x80073712`, which indicates missing or corrupted update files. Microsoft withdrew the faulty preview release and replaced it with a cumulative package that also carries forward March security and quality fixes. The emergency package moves impacted devices to OS builds **26200.8117** and **26100.8117** and also updates several local AI components. Microsoft said the fix is available through **Windows Update**, the **Microsoft Update Catalog**, and manual installation in Settings, while enterprise administrators can accelerate deployment through **Intune** or **Windows Autopatch** expedited quality updates. Because the release combines the servicing stack and cumulative update, rollback options are limited and manual removal may require **DISM**.
Jun 29, 2026