High CPU for multiple processes Microsoft 365

Similar issue here. Found process tree with SysInternals Process Explorer from ofdeploy.exe --> odt<random>.tmp.exe --> conhost.exe.

Both ofdeploy.exe and odt<random>.tmp.exe are signed by Microsoft Corporation.

The parameters proved useful:

C:\WINDOWS\system32\ofdeploy.exe -remote http://go.microsoft.com/fwlink/?LinkID=829801 -id [redacted] -accountid [redacted]

C:\WINDOWS\TEMP\odt1D06.tmp.exe /configure C:\WINDOWS\TEMP\cfg5C24.tmp

??\C:\WINDOWS\system32\conhost.exe 0x4

The cfg<random>.tmp file is the XML driving the ODT Office Deployment Tool. Mine showed:

<Configuration>

<Add OfficeClientEdition="64" Channel="MonthlyEnterprise" Version="16.0.16626.20208">

<Product ID="O365ProPlusRetail">

<Language ID="MatchOS" Fallback="en-us"/>

<Language ID="en-us"/>

<ExcludeApp ID="Groove"/>

<ExcludeApp ID="Lync"/>

<ExcludeApp ID="Bing"/>

</Product>

<Product ID="LanguagePack">

<Language ID="MatchOS"/>

<Language ID="en-us"/>

<ExcludeApp ID="Bing"/>

</Product>

<Product ID="ProofingTools">

<Language ID="en-us"/>

</Product>

</Add>

<Updates Enabled="TRUE"/>

<RemoveMSI/>

<AppSettings>

<Setup Name="Company" Value="[redacted]"/>

</AppSettings>

<Display Level="None" AcceptEULA="TRUE"/>

</Configuration>

The <Setup Name="Company" Value="[redacted]"/> had my company name. This is being pushed out.

The challenge is a 32-bit verses 64-bit mismatch. I have 32-bit office and this is for 64, see first line.

Another in my company uninstalled 32-bit and installed 64-bit, without any luck in fixing. There was talk about having to get ALL office 32-bit including none Office 365 apps like Visio. But that is yet to be proven as a solution as well.

I have been using procexp.exe to identify and kill the process tree. Even clearing the files from C:\Windows\Temp did not stop since IT continues to push this out.

You certainly can get a few running at a time:

I listen for laptop fan and investigate. It is either virus checker scanning OR ofdeploy tree sucking up my CPU!

I wish Microsoft would not do things like running from a temp directory much less a random little *.tmp file with .exe stuffed on the end... This looks so bad with respect to trusted vs malware. But at least it is signed. This drove me into a leaning spike and wasted a lot of time making sure this was trusted. Now I know way more than I ever wanted to about ODT. 😐

I opened a ticket with Microsoft - and after a very long wait - this was their response:

"Apologies for the late reply on this. 

This seems to be a new known issue that is being reported by other users as well. Rest assured that I am already having our internal team check on this. I will let you know if we can confirm a working resolution as soon as possible."

I'm not resting.... or assured...

I too have been having this issue, however, is only 1 user that is intune enrolled. last resort will be to wipe the device, but before doing so, I have opened a ticket with Microsoft.

Please advice what this is and does it ever disappear? 2 processes disappeared yesterday when I restarted computer 2 times and today one process reappeared, fans started breathing like dragon again, taking 32% of CPU one process alone.

I am having the exact same issue on multiple Intune joined devices.