High CPU for multiple processes Microsoft 365

The ChatGPT is strong in this one.

Similar issue here. Found process tree with SysInternals Process Explorer from ofdeploy.exe --> odt<random>.tmp.exe --> conhost.exe.

Both ofdeploy.exe and odt<random>.tmp.exe are signed by Microsoft Corporation.

The parameters proved useful:

C:\WINDOWS\system32\ofdeploy.exe -remote http://go.microsoft.com/fwlink/?LinkID=829801 -id [redacted] -accountid [redacted]

C:\WINDOWS\TEMP\odt1D06.tmp.exe /configure C:\WINDOWS\TEMP\cfg5C24.tmp

??\C:\WINDOWS\system32\conhost.exe 0x4

The cfg<random>.tmp file is the XML driving the ODT Office Deployment Tool. Mine showed:

<Configuration>

<Add OfficeClientEdition="64" Channel="MonthlyEnterprise" Version="16.0.16626.20208">

<Product ID="O365ProPlusRetail">

<Language ID="MatchOS" Fallback="en-us"/>

<Language ID="en-us"/>

<ExcludeApp ID="Groove"/>

<ExcludeApp ID="Lync"/>

<ExcludeApp ID="Bing"/>

</Product>

<Product ID="LanguagePack">

<Language ID="MatchOS"/>

<Language ID="en-us"/>

<ExcludeApp ID="Bing"/>

</Product>

<Product ID="ProofingTools">

<Language ID="en-us"/>

</Product>

</Add>

<Updates Enabled="TRUE"/>

<RemoveMSI/>

<AppSettings>

<Setup Name="Company" Value="[redacted]"/>

</AppSettings>

<Display Level="None" AcceptEULA="TRUE"/>

</Configuration>

The <Setup Name="Company" Value="[redacted]"/> had my company name. This is being pushed out.

The challenge is a 32-bit verses 64-bit mismatch. I have 32-bit office and this is for 64, see first line.

Another in my company uninstalled 32-bit and installed 64-bit, without any luck in fixing. There was talk about having to get ALL office 32-bit including none Office 365 apps like Visio. But that is yet to be proven as a solution as well.

I have been using procexp.exe to identify and kill the process tree. Even clearing the files from C:\Windows\Temp did not stop since IT continues to push this out.

You certainly can get a few running at a time:

I listen for laptop fan and investigate. It is either virus checker scanning OR ofdeploy tree sucking up my CPU!

I wish Microsoft would not do things like running from a temp directory much less a random little *.tmp file with .exe stuffed on the end... This looks so bad with respect to trusted vs malware. But at least it is signed. This drove me into a leaning spike and wasted a lot of time making sure this was trusted. Now I know way more than I ever wanted to about ODT. 😐

Magically, the process creation has ceased today. It stopped occurring after todays quality updates. (i'm in the test ring using Autopatch) I searched for an update that would have anything to do with office deployment tool but nothing stood out. I am just so glad my CPU has returned to normal and no more odt<Random>tmp.exe files are being generated.

Magically, the process creation has ceased today. It stopped occurring after todays quality updates. (i'm in the test ring using Autopatch) I searched for an update that would have anything to do with office deployment tool but nothing stood out. I am just so glad my CPU has returned to normal and no more odt<Random>tmp.exe files are being generated.

I think you're right. Mine stopped yesterday and I was trying to figure out what might have fixed it since I applied those Windows Updates and also updated Office to the newest release (Version 2312 Build 16.0.17126.20132) 64-bit and those rogue processes seemed to have finally stopped...fingers crossed.

Hello Terenzik,

we had the same issue i tried to do a battery reset like half a hour ago. After the battery reset i did not see the Odt__.tmp anymore.

I dont know why it worked and how but what i do know is that is not showing up anymore. But i dont know if it well be permanent. I will keep u in check and will let u know if it solves the problem completely.

Kind greating,

Jarin

Eggenkamp