Since upgrading a server to Server 2025, I’ve been getting multiple OpenWith Application errors every day.
“OpenWith” is supposed to be what is called when you right-click on a file and choose to open it with some program. That’s strange as no one is logged on to the server when this occurs.
I decided to use Sysinternals Process Monitor to try to find out how OpenWith is being used. Filter on Process Name “OpenWith.exe”:
Drop Filtered Events, which should be called Drop Events Excluded from Filter, and let it run:
The next time the error occurred, I went back to Process Monitor. It did not record an attempt to use OpenWith at the time of the error (huh?) but it did have a series of calls a few minutes later. Double-clicking on the Process Start call, I see that the Command line was from C:\Windows\Prey:
I have a Prey Project agent on this machine to aid in recovery if it is every lost. This is not the service itself, but rather a “reinstall” task that runs from Task Manager every 6 hours and 5 minutes:
In C:\Windows\Prey\versions, I see that the latest version 1.13.13. is listed. I ran a a manual update anyway, which first removed the existing version. This took me to a browser to re-connect the machine to my account. That didn’t work:
Checking the dashboard, the device hasn’t connected since February 26. In fact, none of my devices have connected since then.
It’s probably not a coincidence that the the last automatic update was on February 27:
I manually deleted the device from the console and tried the re-install again. Again, the install succeeded but the connection failed. I thought I’d check the forum for updates, but https://community.preyproject.com now returns
upstream connect error or disconnect/reset before headers. reset reason: remote connection failure, transport failure reason: delayed connect error: Connection refused
I might suspect a conflict with antivirus, but SentinelOne is not reporting issues, and they started on the day that Prey installed an update.
Unfortunately, the original OpenWith error is still there.
Wait, now I see an email telling me that the device has been added and is connected?
I’ll see if their support has any suggestions.