Microsoft has deprecated MSI for Office after version 2021 LTSC. Future LTSC releases may move entirely to C2R, making Proplus.ww Ose.exe a legacy component.
By default, OSE terminates after installation. However, if it remains active, stop the Office Source Engine service (if listed as a service) via services.msc and set to Manual. Proplus.ww Ose.exe
index=windows process_name=ose.exe
| where NOT process_path LIKE "C:\\MSOCache\\All Users\\*\\Proplus.ww\\"
OR parent_process NOT IN ("msiexec.exe", "setup.exe")
OR command_line NOT LIKE "%-cache%"
In an extracted Office Professional Plus volume license ISO or network administrative installation point, you will find: Microsoft has deprecated MSI for Office after version
\\server\share\Office_ProPlus_2019\Proplus.ww\ose.exe
For a locally installed copy during setup caching, you may see: By default, OSE terminates after installation
C:\MSOCache\All Users\...\Proplus.ww\ose.exe
During active installation, the process ose.exe runs from the source media path, not from Program Files.
ose.exe will load DLLs from its working directory. Attackers place malicious version.dll, winhttp.dll, etc., alongside it.
OSE creates verbose logs in %temp%\OSE*.log. Use these to pinpoint failing cabinet files or registry keys.