Urgent IT Support: Multiple OneDrive PDF Files Duplicated, Renamed, and Password Protected

Follow these steps to stop the duplication and address the protected PDFs.

1. Stop new duplicate files being created

The duplicate filenames with your computer name (for example, file.pdf and file-DESKTOP-XXXX.pdf) are a known OneDrive behavior when there are credential or sync issues.

A. Clear OneDrive cached credentials (Windows)

1. Press Windows key + R.
2. Enter:

      %localappdata%\Microsoft\OneDrive\settings
   

   and select OK.
3. In that folder, delete the file PreSignInSettingsConfig.json.
4. Restart OneDrive.

If you also see duplicates with the computer name added as described above, additionally refresh cached credentials:

1. Select Start, type Credentials, and open Credential Manager.
2. Go to the Windows Credentials tab.
3. Under Generic Credentials, remove any entries containing OneDrive Cached Credentials.
4. Restart OneDrive.

If duplication continues after this, uninstall and reinstall OneDrive (this does not delete cloud files):

• Download for Windows from the OneDrive download page referenced in the documentation, then reinstall and sign in again.

2. Check for sync conflicts and limit further conflicts

Duplicate filenames can also be caused by sync conflicts when multiple edits or uploads happen at the same time or when files are edited offline.

To reduce further conflicts:

• Avoid editing the same PDF simultaneously from multiple devices while sync is running.
• If a conflict appears, rename one of the files to a unique name and save again.

3. Address the “protected” / locked PDF behavior

The message:

“This PDF file is protected. The reader you are using does not support opening files protected by Microsoft Office.”

indicates the PDFs are protected with Microsoft information protection and require a compatible viewer. This protection is not the same as ransomware encryption.

To open these PDFs:

• Use a Microsoft 365–aware viewer that supports Office-protected PDFs (for example, open them directly from OneDrive or SharePoint in a supported Microsoft 365 app or viewer as configured by your organization).
• If using a third-party PDF reader, it may not support Office-protected PDFs and will show this error.

If these files were not intentionally protected and many PDFs suddenly became protected or unusable, treat this as a potential security incident:

4. Check for signs of ransomware or malicious activity

Ransomware that affects OneDrive/SharePoint typically:

• Modifies many files in a short time.
• Appends or changes file extensions.
• May add ransom note files (for example, names like HELP_DECRYPT, HELP_Recover).

If you see these signs:

1. Immediately stop OneDrive sync on the affected computer (exit the OneDrive client) to prevent further propagation.
2. Work with your admin (if in an organization) to restore files:
   • For OneDrive, use the documented Restore your OneDrive process to roll back the library to a point before the mass changes.
3. Ensure security software is up to date and run a full malware scan on the affected device.
4. Recover original versions of files

If files were modified (whether by sync conflicts or malicious changes), previous versions may be available:

• Use the OneDrive restore or file version history features referenced in the documentation to roll back to earlier, unmodified versions of your PDFs where available.

6. If the problem persists

If, after clearing cached credentials, restarting, and (if needed) reinstalling OneDrive, new duplicates still appear or large numbers of files remain inaccessible, contact Microsoft Support directly and provide:

• Examples of original vs duplicated filenames.
• Approximate time when the issue started.
• Confirmation of any security software alerts or ransomware indicators.

References:

• Duplicate files in OneDrive
• Clear OneDrive cached credentials
• Restrictions and limitations in OneDrive and SharePoint
• Handling ransomware in Sharepoint Online
• Ransomware detection and recovering your files
• What to do when a malicious file is found in SharePoint Online, OneDrive, or Microsoft Teams
• OneDrive issues with BT Web Protect