OneDrive

HEIC and HEIF Files Can’t Be Viewed on Windows 10

If you haven’t come across these file formats already, you probably will soon. Created by the Moving Picture Experts Group (MPEG) and adopted by Apple amongst others, it’s looking like a replacement for the old JPEG image format.

The format was added in iOS11 and created when doing things like taking a photo. Early on the files were being converted back to JPEG in many situations, including OneDrive Photo Roll syncs.

I expect something else has changed recently, as I’m seeing the files turn up over email from other parties where I’d never seen them before. If I find out more I’ll update this post.

.HEIC and .HEIF files ‘appear’ to be the same thing, but at this stage I can’t clearly find information explaining if there’s a difference, and if so what that is.

These files can’t be natively opened on Windows 10 or earlier, but there’s a few options you have to view them.

OneDrive

If you have access to OneDrive or OneDrive for Business (which doesn’t take much, a free Microsoft account will do), you can copy these files into OneDrive, right click and ‘View Online’. Via your browser, you can then view the image in OneDrive without any extra software required. However, Microsoft documentation currently does not list the formats as being supported, and I’m also asking questions about this in a few areas. (Update 3rd March 2020 – Microsoft updated this page after I asked :) )

Windows 10

The native Photos app was supposed to have support for this as per these Insider Build notes. I’ve tested on a few different PCs including a fully patched standard Microsoft build laptop, and Photos doesn’t recognise the files. I’ve been told the support of the files needs the two Windows Store apps, and that matches my testing:

HEIF Image Extensions

HEVC Video Extensions from the Device Manufacturer

Both are created by ‘Microsoft Corporation’ so they’re not third party, and both are free. Once installed, HEIC and HEIF files work everywhere I’ve tried, including in the native Photos app.

There is also a paid HEVC Video Extensions version from Microsoft that costs $1.45AU, I’m not sure why you’d need this one over the one ‘from the Device Manufacturer’.

Frustratingly, the ‘HEVC Video Extensions from the Device Manufacturer’ app doesn’t seem to be available to add in Windows Store for Business, but the HEIF Image Extensions is. I’m asking around to try and have that resolved, if I can find someone to listen to me :) (Update 3rd March 2020 – this probably won’t change anytime soon for licensing reasons)

Converting

One final option is to convert a HEIC to JPEG. Here’s a quick guide using Linux via a Debian WSL image, installed from the Microsoft Store (thanks Purana for the tip!)

I’ve got a lot of unanswered questions in the above, but hoping this at least helps others that might get stuck in finding a working solution in the meantime.

OneDrive for Business – Turn Off ‘Allow Editing’ By Default

Update 21st March 2019

You can now find these settings in the OneDrive Admin Center (Preview) at https://admin.onedrive.com and that’s a clearer experience.

Update 16th April 2020

As the SharePoint Admin Center has been updated, here’s the area to find the view/edit choice:

Original Post

Every organisation has their own requirements and standards. For mine, I see a risk when the default action of sharing a document via OneDrive for Business is the ability to ‘Allow editing’ of any document sent out. It’s worse because that option is hidden behind the main popup when sharing a file, and you don’t actually see that you’re giving ‘modify’ access rather than ‘read only’:

OneDrive for Business default sharing popup
OneDrive for Business ‘Allow editing’ on by default

There is a way to change this default behavior though, and it’s not in the OneDrive admin center.

Instead, you’ll need to head to the SharePoint admin center (since the backend of OneDrive is SharePoint Online, this makes some sense). From here, go into ‘sharing’ and there’s an option around ‘Default link permissions’. You can change this to ‘View’ rather than ‘Edit’:

SharePoint admin center

The change was immediate from my testing, as soon as I went to share another file via OneDrive for Business, the ‘Allow editing’ option was unticked. This is only changing the default too, someone can still decide they want to allow editing and tick the box.

It’s worth considering what you should have as your default. The new versioning in OneDrive/SharePoint Online is really good, and will let a user easily roll back to a previous version of a document if something accidentally gets changed – but will your users be aware if something does change? It’s possible to set up an alert, but it’s a bit tedious: http://itgroove.net/brainlitter/2016/05/16/creating-alerts-documents-new-onedrive-business/

Hope this helps anyone considering rolling out OneDrive, or wants to start allowing external sharing.

OneDrive for Business Auto Sign In – Windows 10

If you’re looking at starting to use OneDrive for Business and you’re working with a PCs joined to a local domain, you can now have a seamless sign in experience for end users (Note that the Group Policy setting for this is in preview according to the documentation).

OneDrive for Business from the client’s perspective has been dropped. It’s just OneDrive now, even though the backend is OneDrive for Business as part of an Office 365 subscription.

You’ll need Windows 10 1709+ for this, as that’s the first version of Windows 10 that has OneDrive baked in. There’s no deployment of the app required then, so you won’t need to use or modify OneDrive for Business. The newer client has much less syncing issues too – if you’re not sure what one you’re using, check what executable is running. OneDrive.exe is the new client, where Groove.exe is the older.

Since OneDrive is part of Windows 10 now, if you aren’t ready for this or don’t want it yet, you’ll need to use the Group Policy setting ‘Prevent the usage of OneDrive for file storage’ which is found in Computer Settings > Policies > Administrative Tempates > Windows Components > OneDrive (note that this is different to the location of where the above new policies sit for OneDrive, which is one level down straight under Administrative Templates).

If you’re migrating from an existing install, then you’ll need to follow this process. Otherwise if you’re starting fresh, there’s a great guide here to go through.

The short version of these steps is:

  1. Windows 10 1709 already has OneDrive, so no deployment required.
  2. Get the ADML and ADMX Group Policy files and deploy them in your environment. Make sure they’re the latest ones too, which you should be able to get from any Windows 10 1709 PC in the path %localappdata%\Microsoft\OneDrive\BuildNumber\adm\
  3. Configure your Group Policies to the settings you want, but the one you’ll need for auto sign in is “Silently configure OneDrive using Windows 10 or domain credentials“. This setting should set the regsitry key [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\OneDrive] “SilentAccountConfig”=dword:00000001. With this setting, there’s an extra registry settings to configure:[HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive] “EnableADAL”=dword:00000001 – This setting enables Modern Authentication for OneDrive.

That’s it!

After this is configured and you log on, the OneDrive client will automatically sign in as the logged on user – assuming you’re properly set up on the Azure AD and Office 365 side of things. There’s no prompt, no notification and users can start using it straight away at their convenience.

Note that if you disabled OneDrive from running at first user login (usually via the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run with something like “C:\Windows\SysWOW64\OneDriveSetup.exe /silent”, you’ll need to retrigger the install. That /silent switch will make OneDrive install and sign in automatically with the above settings.

If you’re planning on moving user’s home drives to OneDrive, you’ll need to manually move the files or run a script like this to migrate the data – or find a paid solution.

Update 26th April 2019:
I had this broken for a while, and found many others that also had it broken. For me, after spending months with OneDrive for Business support, I ended up working out the Group Policy was corrupt in some way. Completely disabling the policy and creating a new one with the identical settings worked.

For context, I had one Group Policy object that disabled OneDrive. A second one with a higher link order, was targeted at certain users and groups to enable OneDrive. That second one was somehow the problem – maybe an update to ADMX files broke it?

Anyway, re-doing that, and using the reg key to deploy OneDriveSetup.exe to run at login with the switch ‘/thfirstsetup’ was all that was needed, and it worked again.

If you’re having problems yourself with this, put a user and computer in an OU that has all policy inheritance disabled, create new GPOs and try to get it to work that way.