Since upgrading a server to Server 2025, I’ve been getting multiple OpenWith Application errors every day.
“OpenWith” is supposed to be what is called when you right-click on a file and choose to open it with some program. That’s strange as no one is logged on to the server when this occurs.
I decided to use Sysinternals Process Monitor to try to find out how OpenWith is being used. Filter on Process Name “OpenWith.exe”:
Drop Filtered Events, which should be called Drop Events Excluded from Filter, and let it run:
The next time the error occurred, I went back to Process Monitor. It did not record an attempt to use OpenWith at the time of the error (huh?) but it did have a series of calls a few minutes later. Double-clicking on the Process Start call, I see that the Command line was from C:\Windows\Prey:
I have a Prey Project agent on this machine to aid in recovery if it is every lost. This is not the service itself, but rather a “reinstall” task that runs from Task Manager every 6 hours and 5 minutes:
In C:\Windows\Prey\versions, I see that the latest version 1.13.13. is listed. I ran a a manual update anyway, which first removed the existing version. This took me to a browser to re-connect the machine to my account. That didn’t work:
Checking the dashboard, the device hasn’t connected since February 26. In fact, none of my devices have connected since then.
It’s probably not a coincidence that the the last automatic update was on February 27:
I manually deleted the device from the console and tried the re-install again. Again, the install succeeded but the connection failed. I thought I’d check the forum for updates, but https://community.preyproject.com now returns
upstream connect error or disconnect/reset before headers. reset reason: remote connection failure, transport failure reason: delayed connect error: Connection refused
I might suspect a conflict with antivirus, but SentinelOne is not reporting issues, and they started on the day that Prey installed an update.
Unfortunately, the original OpenWith error is still there.
Wait, now I see an email telling me that the device has been added and is connected?
I’ll see if their support has any suggestions.
Update April 14, 2025
Seven days later, no answer from support on their Zendesk site. Their Help desk articles don’t even mention the support site. The Uninstall article says to use Twitter or Facebook, which are mostly inactive:
I can see in C:\Windows\Prey\prey.log that the Server 2025 machine is successfully communicating with the Prey back end, but it’s reporting “Unable to get logged_user” even when I’m logged in, and it’s not reporting location even after enabling location services. A request to display an alert was received but no alert was displayed. I guess I’ll uninstall Prey from this device to stop the errors.
On my two laptops, one Windows 10 and one Windows 11, I explicitly set them to allow apps to access the location. That got both of them back online in the Prey dashboard.
Update April 16, 2025
Even after uninstalling Prey following the Uninstall article, the OpenWith errors continue. The C:\Windows\Prey folder is gone, but the “Prey Check” scheduled task is still there. I manually deleted the scheduled task, which stopped the error.
Update April 18, 2025
Yesterday I heard back from Prey support saying that a month and a half ago, they inadvertently pushed beta software testing “self-healing” capabilities. It says the engineering team “developed a solution to restore the proper Prey agent on affected Windows devices,” then advises manually uninstalling and re-installing Prey. It does not mention the scheduled task.