Outlook keeps hijacking default Mail app - even though it's not installed!

@Scott Conrad said

Yes, even after I run the ODT install of Word, Excel, Powerpoint there is still a Microsoft Outlook directory as well. I have attempted to delete this folder

Deleting the Outlook directory probably won't help. It's not that the directory exist, it's that the Office install created it in the first place. That would indicate that it thinks Outlook is part of your deployment. And then on any Office maintenance it's going to rerun it's repair script which is probably what is changing the registry.

"try" disabling the Automatic Office updates to see if that has any effect

Office maintenance is a good candidate. But instead of trying to kill it (that has serious security implications) how about just monitor it? i.e. User reports that the TBird association has been broken, look at the Task Schedule to see if that coincides with an Office maintenance task?

Get-ScheduledTask -TaskPath "\Microsoft\Office\" |
    ForEach-Object {
        $info = $_ | Get-ScheduledTaskInfo
        [PSCustomObject]@{
            TaskName      = $_.TaskName
            LastRunTime   = $info.LastRunTime
            LastTaskResult= $info.LastTaskResult
        }
    } |
    Sort-Object LastRunTime -Descending

e.g. Mine shows:

OK I had another instance this morning. This user did not have their Automatic Updates disabled, but it did re-create the 'Microsoft Outlook' folder in HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail.

-No results returned when using the Get-AppxPackage in Powershell.
-There was NO Outlook.exe in either of the folder locations you specifiedOutlook-02.png

Scott,

Please bear with me, this is getting pretty convoluted and I'm not sure I've got all your answers lines up with the questions.

For the most recent incident:

1 -- Did it coincide with an Office Update as indicated by the PowerShell Task script?

2 -- Under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail

2A - Is it just changing the (Default) value?

2B - Is it also recreating the Microsoft Outlook key? If so, what's under that key? e.g. Mine looks like:

I am ready to keep working this issue with you here, but Office Deployment is not my area of experience. I'm just an Outlook client guy. I'm wondering if you might be better served by:

Bringing in Microsoft Support
https://learn.microsoft.com/en-us/microsoft-365/admin/get-help-support

Working with your favorite AI to see if it has any other ideas.

Post a new Question under the tag Microsoft 365 and Office | Install, redeem, activate | For business | Windows at https://learn.microsoft.com/en-us/answers/tags/335/m365-office-install-redeem-activate-business-platform-windows

1 -- Did it coincide with an Office Update as indicated by the PowerShell Task script? - Judging from my previous screenshot in my previous comment, it does appear that way. Looks like it ran 'Office Startup Maintenance' after the User logged in. App 15-20 mins later the 'Office Feature Updates Logon' ran, and then 15 mins after that the 'Office Automatic Updates 2.0' ran. The user emailed me to fix the registry about 15 mins after that.

2 -- Under HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Clients\Mail - YES

2A - Is it just changing the (Default) value? - YES

2B - Is it also recreating the Microsoft Outlook key? If so, what's under that key? e.g. Mine looks like: **- YES, Please see my screenshot below for what mine looks like

Outlook-registry.png**

Scott,

Based on your latest answers, Copilot and I agree, it's a problem with your Deployment. Either you missed some obscure setting, or the deployment process is broken, but it thinks you have deployed Classic Outlook, and Office Update is "fixing" it for you.

Not something I can help with. See my previous comment for alternatives.

Thank you very much for your help. I don't know how that can be the case, as my XML file contains the following:
<Product ID="O365ProPlusEEANoTeamsRetail">

  <Language ID="en-us" />

  <ExcludeApp ID="Access" />

  <ExcludeApp ID="Groove" />

  <ExcludeApp ID="Lync" />

  <ExcludeApp ID="OneDrive" />

  <ExcludeApp ID="OneNote" />

  <ExcludeApp ID="Outlook" />

  <ExcludeApp ID="OutlookForWindows" />

  <ExcludeApp ID="Publisher" />  

In any event, I greatly appreciate you trying to help and will continue to Trial & Error this.