none
identify which network drive was made manually RRS feed

  • Question

  • Hi,

    Is it possible with Powershell to identify which drive was not manually from the user instead by login script?

    Thanks,

    Thursday, August 22, 2019 3:05 PM

Answers

  • Hi,

    Was your issue resolved?

    If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.

    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

    If no, please reply and tell us the current situation in order to provide further help.

    Best Regards,

    Lee


    Just do it.

    • Marked as answer by FRacine Friday, September 6, 2019 5:17 PM
    Friday, September 6, 2019 12:00 PM
    Moderator

All replies

  • No but you can have the logon script name the drive such that you can tell that it is a logon script created drive.

    Note that this is one more reason why you should not be using logon scripts to create temporary drives.  Use Group Policy and you will be able to tell where the drives came from.

    Mapping drives in a logon script became unnecessary at W2K.  It was only needed in NT4.


    \_(ツ)_/


    Thursday, August 22, 2019 4:45 PM
    Moderator
  • Hi,

    Not sure if this can easily be "identified" with PowerShell, but you have basically four different possibilities:

    1. Group Policy (GPO).

    You can check which GPOs are applied to your computer/server by running the following command in a Command Prompt:

    GPresult /H "C:\Temp\GPOresult.html"

    2. Active Directory (AD) logon script.

    You can check in the Active Directory by using the Active Directory Users and Computers (ADUC) tool, by right-clicking the user, then go to Properties and head to the Profile tab.

    3. Local script with Task Scheduler.

    Open the Task Scheduler and check if there are any scripts that maps network drives.

    4. Manually.

    If you want to identify if a network drive was mapped manually, you would have to enable Active Directory audit logging, from there you can see events for accessing/creating a connection to a network drive.
    For example the following event should be logged: 4624: An account was successfully logged on

    Best regards,
    Leon


    Blog: https://thesystemcenterblog.com LinkedIn:

    Thursday, August 22, 2019 4:46 PM
  • Hi,

    I found if you create a map and set it to reconnect at logon, it is store under HKCU\Network\<The drive letter>\the map informations.

    So is it possible to easily getting this information with get-psdrive (as an example) or something else?

    Thanks,

    Thursday, August 22, 2019 5:16 PM
  • Hi,

    I found if you create a map and set it to reconnect at logon, it is store under HKCU\Network\<The drive letter>\the map informations.

    Thanks,

    Thursday, August 22, 2019 5:17 PM
  • The Get-PSDrive cmdlet will show you the mapped network drives, and as you've noticed when mapping a network drive a registry entry is created:

    Any method you use to map a network drive, it will create a registry entry and be shown under HKEY_CURRENT_USER\Network\<Drive letter>


    Blog: https://thesystemcenterblog.com LinkedIn:

    Thursday, August 22, 2019 6:07 PM
  • Hi,

    Was your issue resolved?

    If you resolved it using our solution, please "mark it as answer" to help other community members find the helpful reply quickly.

    If you resolve it using your own solution, please share your experience and solution here. It will be very beneficial for other community members who have similar questions.

    If no, please reply and tell us the current situation in order to provide further help.

    Best Regards,

    Lee


    Just do it.

    • Marked as answer by FRacine Friday, September 6, 2019 5:17 PM
    Friday, September 6, 2019 12:00 PM
    Moderator