1

I'm trying to get rid of all manually mapped network drives on all workstations in my domain. I want our end-user's mapped drives to be mapped solely via GPO (GPO's are already in place).

I'm trying to write a script that will:

  1. Unmap all network drives when the user logs in
  2. Run gpupdate /f to re-map drives based on applied GPO

I'm planning to have this logon script policy applied only for a few weeks, until I can verify that all manually mapped drives are gone.

Here is the contents of my batch script:

REM Delete all mapped drives
net use * /del /y

REM force a group policy update to map all drives according to GPO's.
gpupdate /force 

REM create a directory to verify the script is actually running.
mkdir %USERPROFILE%\test

I've placed this script on my NETLOGON directory on my domain controller. The script runs as intended if manually run from this directory. However, when applied as a logon script, the net use /delete /yes command doesn't seem to work. I've verified that the script is actually running during logon with the mkdir %USERPROFILE%\test.

I've even tried to redirect the output of the first command net use * /del /y > result.txt and the output came out as

"There are no entries in the list"

Is there any reason why my script is working when I run it manually, but not as a logon script?

Server: Windows 2012R2
Host: Windows 10

8
  • It may be running too early. Try putting a delay in the script of a few minutes. ping shows you how to add a delay using ping. – DavidPostill Apr 25 '16 at 19:11
  • 2
    This doesn't answer your question, but you may want to run the unmapping script as a logoff script. That way you don't compete with GPO mapping the drives, and the drives should be mapped at logoff (meaning they exist and you can unmap them). – Patrick Seymour Apr 25 '16 at 19:29
  • @DavidPostill I just tried adding a sleep 300 before the unmap command, and other sleep 100 before the gpupdate /f. The output still says "There are no entries in the list." – Francis Batalla Apr 25 '16 at 19:35
  • @PatrickS. I've switched the script to run at logoff instead. Also, I've shortened the script to contain ONLY the unmapping drives cmd and a script run verification (send output to text file). My drives are still remaining mapped. Any other suggestions? – Francis Batalla Apr 25 '16 at 19:46
  • My comment wasn't intended as an answer, just a suggestion on when to run the script. In fact, I tried what you're doing, and it worked for me on a Windows 10 machine. – Patrick Seymour Apr 25 '16 at 20:23
0

I just had issue using net use g: /delete /yes on WIndows 2012R2, it was causing mapping conflicts. My G drive mapping would map to other servers, and sometimes additional z mapped drive appeared that was a ghost. It's wasn't in the batch script

If you Must delete network drives before the actual mappings using shares on Server 2012R2, use net use g: /del (ONLY)...this will work on 2012R2 Server

MJ

1
  • So you are saying to first run NET USE G: /DELETE and explicitly delete all possible mapped drive letters that way rather than using the asterisk to do all drive letters regardless of the mapped drive letter, correct? – Pillsbury IT Doughboy Aug 9 '17 at 1:37
0

If the user in question is an administrator, (un)mapping drives using scripts won’t work.

With UAC, you have two tokens and login sessions: one with all permissions (“elevated”) and one with limited permissions only. Scripts started by GPOs run with full permissions.

Mapped drives are tracked per session. When you try to map or unmap drives from logon/logoff scripts, they will only be available to programs running elevated. Explorer never runs elevated by default.

Here’s more info directly from Microsoft.

To work around this, use the following .reg script. After that, changes to mapped shares will affect both the full and limited token.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLinkedConnections"=dword:00000001

This also fixes errors when trying to run setups (or other stuff that runs elevated) from mapped drives.

2
  • So if I changed the registry I can unmap a drive through an elevated script? Also how and where do I run this .reg script? – Tak May 11 '20 at 7:13
  • You need to apply it once, per PC. Yes, you should then be able to delete mapped network drives from either session (elevated and normal). – Daniel B May 11 '20 at 7:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.