- someone had horribly slow Windows (opening folder with photos has not completed after several minutes) - no typical signs of a malware or other infestation otherwise - OneDrive asking to be "upgraded" (which went straight to payment form)

Turns out that Windows was uploading local files to Microsoft servers (OneDrive). User was not aware about this, presumably it appeared in way similar how most people end with Microsoft account during installation.

In addition it turned that OneDrive deleted local files. User was definitely not aware about that.

So someone opening folder with photos - was downloading them from server. No idea who thought that it would be better than simply mirroring files. Opening folders was slow because user was waiting for download of GBs of data.

Attempts to change configuration were without any feedback or noticeable change. Linux would at give cryptic but searchable error.

Uninstalling OneDrive resulted in Windows stopping to pretend that local files are there.

At least message asking for OneDrive subscription, appearing every 30s, was also gone.

After that it was necessary to download files from OneDrive. Which failed in the middle of download twice and was rate limited to 250 KB/s by Microsoft server. Which makes idea "lets delete GBs of files locally and download them when user opens folder" even worse.

I guess that the entire idea was invented to push OneDrive subscriptions (many people will simply pay as popup demanded) but who though that deleting local files is a good idea?

Also, it is not just one person who did something weird, it happened to multiple. So I guess that it is one more thing to be aware while helping with horribly slow Windows and one more dark pattern to look out for.

BTW, it is really sad that "Linux PC becoming more usable than Windows PC" is driven recently mostly by Windows becoming worse.

Also, that is how "lets give family member external hard drive and help with backup making as a gift" turned out to be 1h of investigation and several of waiting rather than 5 minutes of copying.