Teams Wide Machine installer

Question

We need to mitigate the “Microsoft Teams Heap Buffer Overflow Vulnerability (Sep 2023)” flagged in our vulnerability scans.

After tracing the affected files, we found they reside in the Teams folder under the user’s AppData. Further investigation showed this folder is left behind from previous Teams updates—the Teams installer does not fully clean up old versions.

The source of the issue was the Teams Machine-Wide Installer. Actions taken so far:

Removed the Teams Machine-Wide Installer via an Intune script

Disabled Teams in the Office 365 app deployment in Intune

Currently deleting the leftover Teams AppData folders

Created a new Teams deployment via the Microsoft Store (new method) – not yet deployed

Despite this, the vulnerability continues to reappear, and more devices are now being flagged.

Questions:

How can we prevent future Teams installations from recreating the AppData Teams folder?

1. Is deploying Teams via the Microsoft Store the correct long-term approach?
2. How can I make sure I am installing teams for work without adding personal teams?
3. Why is Microsoft Teams installation/uninstallation so inconsistent and difficult to manage?

Answer 1

Hi @Saif Almodares,

Thank you for the follow‑up.

Here is a clear Intune‑first remediation plan that answers your three questions:

1. Remove the Teams Machine‑Wide Installer (MWI)

The classic MWI silently stages a per‑user install into AppData\Local\Microsoft\Teams at sign‑in, which is why legacy binaries keep reappearing. Microsoft’s uninstall guidance notes automatic removal may fail, so admins should proactively uninstall MWI.

Intune steps:

• Apps → Add → Windows app (Win32)
• Upload a small placeholder installer (any benign file; the action is driven by the command).
• Install command (cmd.exe): msiexec /x {731F6BAA-A986-45A4-8936-7C3AAAAA760B} /qn /norestart
• Detection: confirm the product code is absent from HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{731F...760B} (and WOW6432Node).
• Assignment: Required to target device groups.

2. Remove Teams leftovers in user AppData (no scripts)

If classic Teams was ever present, user profiles can retain:

• %LOCALAPPDATA%\Microsoft\Teams
• %APPDATA%\Microsoft\Teams

Preferred (if you have AD/GPO):

• Use Group Policy Preferences (GPP) → User Configuration → Preferences → Windows Settings → Folders/Files
  • Create items with Action = Delete for both paths above.
  • GPP deletes the folders at logon/Group Policy refresh without any scripting.

Intune‑only environments (no on‑prem GPO):

• Remove the MWI (step 1) so the folder isn’t re‑created.
• Deploy new Teams (step 3) so devices stop using the legacy path.
• For the one‑time cleanup of existing remnants, use a temporary GPO (if hybrid) or an RMM tool that supports non‑script file actions.

 

3. Install new Teams (work or school) via Intune (no scripts)

You have two supported choices:

A) Line‑of‑Business (MSIX)

1. Download MSTeams‑x64.msix (Teams for work/school).
2. Apps → Add → Windows app (MSIX) → upload → Assign as Required.
3. Ensure WebView2 Runtime is present and Delivery Optimization (DO) is enabled (Teams uses DO for updates; Download Mode 100 (Bypass) isn’t supported).

B) Microsoft Store (new) via Intune

1. Apps → Add → Microsoft Store app (new)
2. Search “Microsoft Teams (work or school)” (Microsoft) → Assign as Required.
3. This aligns with Microsoft’s bulk‑deploy guidance for the new Teams MSIX client

4. Prevent Office from re‑adding classic Teams

• Update the Microsoft 365 Apps deployment to exclude Teams (classic) so Office doesn’t stage the legacy per‑user installer again.

5. Ensure users get work Teams only (not personal)

• If Microsoft Teams (personal) is present, add that Store app in Intune and set Assignment = Uninstall, leaving only Microsoft Teams (work or school) for your organization.

I hope this helps you address your concern quickly. I'm glad to assist and truly hope the information provided has been useful. Please feel free to reach out anytime if you need further assistance.   

If you find my post helpful, kindly consider marking it as the accepted answer. Doing so can assist others in the community who may have similar questions in finding solutions more quickly.   

Thank you for your kindness and contributions to the forum.  

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi @Saif Almodares,

Welcome to Microsoft Q&A forum. 

Thank you for bringing this to our attention. I understand your concern regarding the recurring vulnerability related to Microsoft Teams and the challenges with leftover AppData folders and inconsistent uninstall behavior.

By way of background, Microsoft addressed two heap‑buffer‑overflow issues in Sep/Oct 2023 affecting libraries used by Teams (and Edge/Skype): CVE‑2023‑4863 (libwebp/WebP) and CVE‑2023‑5217 (libvpx/VP8). Consequently, Teams desktop builds (e.g., 1.6.00.26474) were updated. However, the classic Teams (v1, Electron) client installs per user under AppData\Local\Microsoft\Teams\current\Teams.exe and only self‑updates when that specific user signs in. Therefore, infrequently used admin/support profiles can retain stale executables that scanners keep flagging, even after your org moves to the new Teams.

Here are answers to your questions:

1. How can we prevent future Teams installations from recreating the AppData\Local\Microsoft\Teams folder?

You can remove the classic Machine‑Wide Installer (MWI), thoroughly clean per‑user remnants across all profiles/hives, and standardize on new Teams (MSIX) via bootstrapper/offline packages. Additionally, ensure Microsoft 365 Apps doesn’t re‑introduce classic Teams.

• Uninstall the classic Teams MWI: Microsoft notes automatic removal can fail; therefore, proactively uninstall it wherever it was deployed directly: msiexec /x {731F6BAA-A986-45A4-8936-7C3AAAAA760B} /qn /norestart Then verify it’s gone in Apps & Features.
• Clean all per‑user leftovers (files + registry) across every local profile: Delete C:\Users\<user>\AppData\Local\Microsoft\Teams\ and remove HKU\<SID>\Software\Microsoft\Teams. Because user hives can be locked when a user is logged in, run this at startup (System context), loading and unloading each hive; many admins report this finally stopped Defender re‑flags.
• Stop Office from re‑installing classic Teams: Configure your Microsoft 365 Apps deployment to exclude Teams classic (or plan separately for new Teams), so consequently the legacy installer isn’t staged again.
• Optional guardrail for special accounts: Set HKCU\Software\Microsoft\Office\Teams\PreventInstallationFromMsi via GPO for admin/support accounts so the legacy per‑user install does not re‑trigger.

2. Is deploying Teams via the Microsoft Store the correct long‑term approach?

Deploying the new Teams (MSIX) is the long‑term path. However, you don’t have to use the Store. Microsoft provides TeamsBootstrapper.exe and an offline MSIX so you can deploy via Intune, ConfigMgr/SCCM, or scripts - with no Store dependency.

• Bulk‑provision with TeamsBootstrapper to install Teams MSIX for all users on a device (and any users added later).
• Alternatively, deploy the offline MSIX in limited‑connectivity scenarios.
• Moreover, ensure WebView2 runtime and Delivery Optimization settings are in place for servicing and updates.
• In VDI/shared environments, new Teams (MSIX) installs under Program Files\WindowsApps (machine scope) and stores per‑user data in AppData\Local\Packages\MSTeams_8wekyb3d8bbwe—thus avoiding the legacy AppData\Local\Microsoft\Teams\current\Teams.exe.

For your reference:

• Bulk deploy the Microsoft Teams client.
• Installing the New Teams Client in VDI Environments

Note: Microsoft provides this information only as a convenience to users. These websites are not controlled by Microsoft, and Microsoft does not guarantee the quality, security, or suitability of any software or information on them. It is important to fully understand the risks involved before using any of the suggestions in the links above. 

Many admins prefer MSIX over the Store for control, auditing, and offline capability; nevertheless, Store deployment is fine if your policy allows it and your update rings are well managed.

3. Why is Teams installation/uninstallation so inconsistent and difficult to manage?

Because there are two eras with different behaviors:

Classic Teams (v1, Electron, pre‑2024):

• Per‑user installs into AppData; the Machine‑Wide Installer merely staged that per‑user install at logon.
• Self‑updates only when the specific user runs Teams; dormant profiles retain stale binaries that scanners flag.
• Therefore, complete removal requires cleaning every profile and HKU hives - not just the current user.

New Teams (v2, MSIX, 2023+):

• MSIX delivers a machine‑provisioned app under Program Files\WindowsApps, serviced via Delivery Optimization with a slimmer footprint.
• Additionally, admin tooling (bootstrapper/offline MSIX) avoids Store dependency, and prerequisites (e.g., WebView2) are documented for reliable rollout.

As a result, many organizations that coexisted classic and new Teams accumulated inconsistent leftovers; even Microsoft notes classic removal may fail due to permissions/settings, therefore requiring admin‑driven cleanup.

For your detail, please refer to this article: Uninstalling classic Microsoft Teams.

I hope this information is helpful. Please follow these steps and let me know if it works for you. If not, we can work together to resolve this.    

Thank you for your patience and your understanding. If you have any questions or need further assistance, please feel free to share them in the comments on this post so I can continue to support you. 

I look forward to your thoughts on this. 

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.