Windows Cloud Files Filter Driver (CldFlt) randomly getting disabled across multiple users — causes OneDrive Files On-Demand failure/disappear and mass re-download of sharepoint folder (Windows 11 25H2)

Jayadeepan Sathyamoorthy 0 Reputation points
2026-05-14T07:00:56.4533333+00:00

Multiple users in our Windows 11 25H2 tenant (Build 26200.8457) are experiencing a sudden failure where every file synced through OneDrive (Office, PDF, etc.) becomes unopenable with "file format or file extension is not valid" errors, and OneDrive simultaneously triggers an unsolicited mass re-download of all synced content (one machine queued 661 GB / 625,378 files). Root cause traced to the Windows Cloud Files Filter Driver (CldFlt): the registry value HKLM\SYSTEM\CurrentControlSet\Services\CldFlt\Start is being silently changed from 2 (Automatic) to 4 (Disabled), so the driver does not load at next boot and Files On-Demand placeholder files become unreadable. No Event ID 7040 is logged (indicating the change is a direct registry write, not via the Service Control Manager), and no Event 4657 was captured (registry auditing was not enabled prior to the incident). The issue is hitting users in a rolling, one-machine-at-a-time pattern over multiple days within the same tenant.

Per-machine workaround works reliably: reset Start to 2, reboot, uninstall and reinstall OneDrive. Environment: Defender platform 4.18.26030.3011, Sense client 10.8821.27906.1000 (observed crashing 7 times in 3 minutes during the affected window), MDE configuration version 10.8834.main.2026.05.09.01, Tamper Protection currently disabled, OneDrive client 26.070.0414.0001 (per-machine install), managed via Microsoft Intune. Seeking guidance on which Microsoft component is making the change and how to identify the originating process on already-affected machines.

Microsoft Security | Microsoft Defender | Other
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-05-14T07:01:26.52+00:00

    The provided context contains guidance on how CldFlt should be configured for OneDrive Files On-Demand, but does not identify any specific Microsoft component that changes HKLM\SYSTEM\CurrentControlSet\Services\CldFlt\Start from 2 to 4, nor any method to retrospectively determine which process performed that change on already-affected machines.

    The only directly relevant information is:

    • For Files On-Demand to work, the Windows Cloud Files Filter Driver (CldFlt) must be configured to start automatically. The documentation states that the Files On-Demand feature sets the following registry value to 2 (AUTO_START):
      • [HKLM\SYSTEM\CurrentControlSet\Services\CldFlt]"Start"="dword:00000002"
    • If this value is not 2, Files On-Demand will not function correctly and the option may not appear in OneDrive settings.

    Mitigation from the context (which aligns with what is already being done):

    1. Ensure the CldFlt service is set to automatic:
      • Set HKLM\SYSTEM\CurrentControlSet\Services\CldFlt\Start to 2 (AUTO_START).
    2. Reboot the device so the Cloud Files Filter Driver loads.
    3. Verify Files On-Demand is enabled in OneDrive:
      • Right-click the OneDrive icon in the notification area → Settings.
      • Confirm that Save space and download files as you use them is enabled for each configured OneDrive account.

    These steps restore the driver and Files On-Demand behavior but do not provide a way, from the supplied material, to attribute the registry modification to a specific Microsoft Defender or other component, nor to reconstruct the responsible process after the fact.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.