Networks·41,424 discussions

Phantom Mapped Drives

Locked

We have a PC running Windows XP in a Domain environment, and it has all its updates. This user needs access to 5 folders on the server, and has drive mappings to them using v,w,x,y,and z. What’s been happening on this machine is phantom mapped drives are filling up the available spaces in between… g-u, typically they are pointing to the same shared folder, they’ll display as being ‘disconnected’ (and thus unremovable); though the folder is accessible. I had recreated the profile for this user, and things worked fine for several days, now they’re back. We are all scratching out heads over this one. The desired mappings v-z are all available and working fine. The user is not having any other issues on this PC, and is used to ignoring the ‘disconnected’ drives. We’re just baffled by this one…

Topic

Clarifications

In reply to Phantom Mapped Drives

Clarifications

Just responding

In reply to Phantom Mapped Drives

to move the question closer to the top. The issue has spread to 2 additional computers now.

Is there any possibility

In reply to Just responding

That this is viral? When it was just one pc infected, I scratched my head awhile and could think of nothing that might help outside of rebuilding the user profile- which you have done, only to have the problem return.

I’m sure that you have AV and your network is firewalled but virus can get in. Is it possible?

The only other thing I can think would be to check permissions on the folders that are appearing as a-u.

If nothing else, this will get you back up to the top of the churn again. Maybe Mycroft will see it.

Not a virus, Tig. This is a bug in Windows and I’ve found a fix for it

In reply to Is there any possibility

This problem stems from the way drives are mapped as it uses the original and cached credentials to authenticate to the mapped drives. If the network drives were mapped when the PC was still in a workgroup, those local credentials were used to map. If the machine is later joined to the domain, guess which credentials are still being used to map to the network drives? Yes, the old local user credentials which are now invalid, yet when the user double clicks on the disconnected drive, it’s accessible because NTFS and share permissions are enumerated and realize that the user does have the proper permissions indeed. There is a slight reg hack that needs to done to get rid of the disconnected drives. Here it is:

run regedit and navigate to the following key:

HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\
EXPLORER\MOUNTPOINT2

For each disconnected network drive letter, create a new key under Mointpoint2 to be the name of the disconnected drive letter (e.g. G for G: drive…do not use the colon in key name)

Under the newly created key, create a new string called BaseClass and give it a value of Drive

Repeat this process for every disconnected network drive letter and then close the registry.

Reboot the PC and proceed to remove the disconnected network drive(s). This reg hack will need to be repeated on every machine with this problem, servers included.

I have never heard of that before!

In reply to Not a virus, Tig. This is a bug in Windows and I’ve found a fix for it

Is the reg hack something that can be scripted? I would hate to think the poor guy is potentially looking at having to do that by hand throughout the network. And the registry can be a dicey place to begin with.

But really good information. Thanks!

Remind me if I open a question that I owe you a thumb.

Thanks for the tip

In reply to I have never heard of that before!

I’ll let you know how it works out. Funny thing is, I found a post concerning the exact same thing on Microsoft’s website, and no answer given. As far as these machines belonging to a workgroup; they’ve been attached to this domain about 2 years. I recall there being a problem with the Domain Controller replacement awhile back; and all the pc’s on the LAN needing to be disjoined/rejoined.

This problem seems to plague persistent drive mappings

In reply to Thanks for the tip

Believe me, I support a small medical office in which I setup their LAN and DC and have been banging my head against the wall for 2 weeks with this problem until I found the solution. I have noticed that if you don’t flag the drives to be persistent upon mapping, you don’t see this issue. Another headache MS left us poor IT folks to deal with, as if we don’t have enough as is.

Well, disjoining and rejoining from DC effectively puts them in a workgroup

In reply to Thanks for the tip

and since I’m sure they have had persistent drives mapped when joined to the domain, the problem manifested itself as you see it now.

This can be scripted to create the keys, strings, and values

In reply to I have never heard of that before!

But the script would have to be modified accordingly based on the network drive letters in question. I just provided the key names and values as an example of what to do, but I see no reason as to why this can’t or shouldn’t be scripted.

Worked Fine

In reply to This can be scripted to create the keys, strings, and values

Thankfully, I only had to do this on 2 machines here on our LAN. So far, so good… no unwanted drives popping back up! I’m glad this solution will be part of TechRepublic now; heaven knows I couldn’t find the solution anywhere on the web, even Microsft’s site!

Hey John!

In reply to Worked Fine

Remember to give Maniac another thumb! And thank you for thinking to give him one in the first place! That was some serious digging he did!

Yep- impressed even me.

Problem has returned

In reply to Phantom Mapped Drives

and spread. The registry fix seemed to work for a few days, but now the same thing is happening, and on two additional pc’s. No matter what letters are assigned as mapping, the ‘phantom’ mappings fill up the available drive letters. It’s not causing any problems to our users… just puzzling for us.

How are you mapping the drives?

In reply to Problem has returned

Are you doing it from a batch file called by the user’s profile at login, or do you have them mapped locally at the computer and set to reconnect? Are all of the five drives getting assigned to additional letters, or just some of them? Is there a new app that’s mapping the drive in the background?

These were

In reply to How are you mapping the drives?

mappings that were set up at each computer about 2-3 years ago (Through My computer, Map Netowrk drives, and yes it’s checked to reconnect). They’ve been working fine all this time; the issue just started a couple of weeks ago. Only one of the mapped drives repeats itself into the ‘Phantom’ drives. And though they appear as disconnected, they are accessable by double clicking on them. I originally thought there must be an app doing this in the background, but now that it’s spread to other computers, I’ve ruled that out.

Persistent drive mappings cause this stupidity

In reply to These were

Repeat the steps I provided if these new phantom drives show up as new drive letters, but uncheck the reconnect drive box, as that is causing the persistent mapping problem.

[Author]

Replies