High CPU for multiple processes Microsoft 365

Magically, the process creation has ceased today. It stopped occurring after todays quality updates. (i'm in the test ring using Autopatch) I searched for an update that would have anything to do with office deployment tool but nothing stood out. I am just so glad my CPU has returned to normal and no more odt<Random>tmp.exe files are being generated.

I think you're right. Mine stopped yesterday and I was trying to figure out what might have fixed it since I applied those Windows Updates and also updated Office to the newest release (Version 2312 Build 16.0.17126.20132) 64-bit and those rogue processes seemed to have finally stopped...fingers crossed.

Magically, the process creation has ceased today. It stopped occurring after todays quality updates. (i'm in the test ring using Autopatch) I searched for an update that would have anything to do with office deployment tool but nothing stood out. I am just so glad my CPU has returned to normal and no more odt<Random>tmp.exe files are being generated.

Similar issue here. Found process tree with SysInternals Process Explorer from ofdeploy.exe --> odt<random>.tmp.exe --> conhost.exe.

Both ofdeploy.exe and odt<random>.tmp.exe are signed by Microsoft Corporation.

The parameters proved useful:

C:\WINDOWS\system32\ofdeploy.exe -remote http://go.microsoft.com/fwlink/?LinkID=829801 -id [redacted] -accountid [redacted]

C:\WINDOWS\TEMP\odt1D06.tmp.exe /configure C:\WINDOWS\TEMP\cfg5C24.tmp

??\C:\WINDOWS\system32\conhost.exe 0x4

The cfg<random>.tmp file is the XML driving the ODT Office Deployment Tool. Mine showed:

<Configuration>

<Add OfficeClientEdition="64" Channel="MonthlyEnterprise" Version="16.0.16626.20208">

<Product ID="O365ProPlusRetail">

<Language ID="MatchOS" Fallback="en-us"/>

<Language ID="en-us"/>

<ExcludeApp ID="Groove"/>

<ExcludeApp ID="Lync"/>

<ExcludeApp ID="Bing"/>

</Product>

<Product ID="LanguagePack">

<Language ID="MatchOS"/>

<Language ID="en-us"/>

<ExcludeApp ID="Bing"/>

</Product>

<Product ID="ProofingTools">

<Language ID="en-us"/>

</Product>

</Add>

<Updates Enabled="TRUE"/>

<RemoveMSI/>

<AppSettings>

<Setup Name="Company" Value="[redacted]"/>

</AppSettings>

<Display Level="None" AcceptEULA="TRUE"/>

</Configuration>

The <Setup Name="Company" Value="[redacted]"/> had my company name. This is being pushed out.

The challenge is a 32-bit verses 64-bit mismatch. I have 32-bit office and this is for 64, see first line.

Another in my company uninstalled 32-bit and installed 64-bit, without any luck in fixing. There was talk about having to get ALL office 32-bit including none Office 365 apps like Visio. But that is yet to be proven as a solution as well.

I have been using procexp.exe to identify and kill the process tree. Even clearing the files from C:\Windows\Temp did not stop since IT continues to push this out.

You certainly can get a few running at a time:

I listen for laptop fan and investigate. It is either virus checker scanning OR ofdeploy tree sucking up my CPU!

I wish Microsoft would not do things like running from a temp directory much less a random little *.tmp file with .exe stuffed on the end... This looks so bad with respect to trusted vs malware. But at least it is signed. This drove me into a leaning spike and wasted a lot of time making sure this was trusted. Now I know way more than I ever wanted to about ODT. 😐

The ChatGPT is strong in this one.

I opened a ticket with Microsoft - and after a very long wait - this was their response:

"Apologies for the late reply on this. 

This seems to be a new known issue that is being reported by other users as well. Rest assured that I am already having our internal team check on this. I will let you know if we can confirm a working resolution as soon as possible."

I'm not resting.... or assured...