Willy Wonka and the Drive Letter Factory

I needed to take apart my blog about SSO from Azure Ad Joined devices to your on-premises old-school legacy file server because there was too much information to tell.

So I decided to remove the blog about how to mount the Drive Letter with Intune parts and dedicate a special blog to it. So both of these blogs could the attention they need…

I will divide this blog into multiple parts

  1. Drive Letter Mappings
  2. Solving the Red cross and disconnection warning!
  3. Making the Drive letters more beautiful
  4. How to deal with those weird characters!
  5. How to deal with the %username%
  6. Mapping a drive letter to sharepoint
  7. Drive Mappings gone Missing

1. Drive Letter Mappings

How are we going to mount or remove drive letters to our on-premises file servers when we have not yet migrated the data to SharePoint?

Are we going to map some old-fashioned drive letters with the use of PowerShell? I guess everyone has deployed Adminless and Applocker and of course, you made sure your Applocker policy will block PowerShell for the regular users. What to do now?

Assuming we all have the Azure Ad connect requirement in place to get SSO from our AADJ devices to our on-premises environment let’s go forth!

In some older blogs I showed you the possibility to ingest some ADMX templates to configure some additional settings, so why not do the same for the drive mappings?

The only thing you will need is the Drive mapping ADMX file which you will find here:

Download the ADMX files!

First, we need to configure the CSP for the ADMX

OMA-URI: ./Device/Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/DriveMapping/Policy/DriveMappingAdmx
Data Type: String
Value:  content of the drivemapping.admx file

1.1 Adding the Drive Letters

And of course, a separate CSP for the drive mappings and itself

OMA-URI: ./user/Vendor/MSFT/Policy/Config/DriveMapping~Policy~DriveMapping/Drive_H
Data Type: String
Value:  <enabled/>
	<data id="Drive_H_RemotePath" value="\\fileserver\fileshare"/>

While waiting for the custom-made policy to apply, look at the registry to check if you already can find the ADMX policy inside the HKLM\Software\Microsoft\Policymanager\Admxinstalled registry key

As shown above, the ADMX drive mapping is installed without any problems and within a few minutes, the drive mapping itself started showing up in the registry. HKLM\Software\Microsoft\Policymanager\Current\SIDId

After logging off and logging on again, the drive mappings popped up and were ready for use.

1.2 Removing the Drive Letters

When you want to remove some of the Drive Letters, please make sure you change “Enabled” value to “Disabled” instead of removing it or changing it to not configured.

OMA-URI: ./user/Vendor/MSFT/Policy/Config/DriveMapping~Policy~DriveMapping/Drive_H
Data Type: String
Value:  <disabled/>
	<data id="Drive_H_RemotePath" value="\\fileserver\fileshare"/>

Why? I guess it’s all about the tattooing issue still exist

2. Solving the Red Cross and Disconnection Warnings

Okay, we have our drive mappings, but what about the disconnection warnings and the red crosses? Let’s fix it.

1: RestoreConnection

Please make sure you also add this CSP to make sure you don’t get any reconnection warning

OMA URI: ./user/Vendor/MSFT/Policy/Config/DriveMapping~Policy~DriveMapping/ReconnectNetworkDrivesWarning

Value: <disabled/>

Another possibility would be to deploy a PowerShell script to the devices with this content

New-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Control\NetworkProvider -Name RestoreConnection -PropertyType DWord -Value 0 -Force

2. Solving the Red Cross/Disconnection issue

Sometimes you could end up with this red cross error. It looks like you can’t open the drive letter.

To solve this stupid issue, you need to make sure the Network Drive ProviderFlags is set to 1. This “key” controls the recovery of network shares. Your drive mappings will use Server Message Block (SMB) version 1 when they are stored in the registry. Again there are 2 options to configure this setting.

If you have opened the ADMX file, you will notice I already have added this “ProviderFlags” for you! So you won’t have to. Thanx José Luiz (@schenardie) / Twitter for the heads up!

Please Note: It’s enabled by default, if you want to disable it please change the “Value” back to 0

Again another possibility would be to create a PowerShell script to change this registry key. You will need to make sure it’s targetted at the HKCU

REG ADD “HKCU\Network\P” /v “ProviderFlags” /t REG_DWORD /d “1” /f

(change the P to one of the drive letters you are experiencing the issue with)

3. Making the Drive Letter Names more Beautiful

Totally forgot to mention this part. Looking at the drive label names… it doesn’t really look that nice does it?

If you want to specify a nice name to it, we need to open the registry first and browse to:


You will notice, all of your Drive Letters show up here.

I decided to export them first

I opened the export reg file and add the _LabelFromReg with a nice name to each Mountpoint.

When you are blocking PowerShell you can deploy this reg file to your device by using this trick, you could even create proactive remediation to be sure the drive letters are always having a nice description.

If you don’t block PowerShell, it’s a lot easier of course. Just create a PowerShell script that is deployed to the user context

reg add “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##servername#sharename” /f /v “_LabelFromReg” /t REG_SZ /d “NewLabel”

You will need to change the server name and share name to the value you have seen in the registry key


4. How to deal with those weird characters!

Of course, we all know, that sometimes we could have some weird characters in our share name. Luckily spaces are not one of them but unfortunately the & is. Like an example “\\fileserver\engineering & research”. So how to deal with that? Luckily we could also add those in the CSP

& –> &amp;

So let’s take our example and change the CSP, so it is going to work

\\fileserver\engineering &amp; research

5. How to deal with the %username%

When you still need to map some drive letters to your on-premises file server, for the time being, you maybe need to map a drive letter for the user’s home folder.

I guess we all know the variable to make this happen when your home folders look like this \\fileserver\homefolders\rudyooms. When running the login script/GPO in the user context the variable to do so is %username%

But unfortunately this “could” be hard to do with the ADMX, unless you add something to each element

To make sure you can use the %username% you will need to add this expandable=”true” to each element in the ADMX you ingested!

Also please make sure you took on my advice to REG ADD “HKCU\Network\P” /v “ProviderFlags” /t REG_DWORD /d “1” /f . Otherwise, you will still end up with some red crosses!

6. Sharepoint Drive Mapping

I did some tests if it would also work when you want to map a drive letter for a SharePoint site, but unfortunately, it doesn’t (yet?) map the drive letters with the web protocol. Next week a new deep-dive I guess

7. Drive Mappings gone missing!

I guess I also need to add this part, as we have seen this happening from time to time. Let me tell you the issue first.

After we migrated the data to SharePoint, we made sure we configured the existing values to be disabled. For 90% of all devices, this went totally okay! no problem whatsoever but on 10% of the devices, all the drive letters were missing?

After expecting everything we noticed that these users were made local admin by the local it department before? That’s totally not okay! Somehow the drive mapping didn’t show up in the explorer session of the user. It’s all because of UAC. Luckily Microsoft has a good article about this issue

Mapped drives are not available – Windows Client | Microsoft Docs

So for now we created the DWORD EnableLinkedConnections with the value of 1 in this reg key to fix it at this moment.

Set-ItemProperty -Path “HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” -Name “EnableLinkedConnections” -Type DWord -Value 1

Please Note: If this option arrives at Intune, I will update the blog


When going full cloud, there is still a possibility you will need to make sure your users could access the old school file servers. As I showed in the deliver us from the Hybrid blog, you can do so with SSO. But why not provide your users a nice drive letter until you can move all the data to OneDrive/SharePoint?

Captain Obvious GIF by Memecandy

5 thoughts on “Willy Wonka and the Drive Letter Factory

  1. Hi Rudy, great article, thanks. There’s just one thing holding me back from using this. How do i make sure a user loses the drive mapping when he is removed from a group? Without making this manual proces which will be prone to error?

    1. Hi,

      Normally we also configure the opposite setting (multiple configu CSP’s) to disable/remove that drive mapping and assign it to a group with at that point no one In it. So each drive mapping to remove has a separate policy and assigned to a group
      So when a user doesn’t need that drive letter anymore, we remove the user from the main csp and add him/her to one to remove it… It will cost you some time to set it up at first… but onceconfigured, you only need to remove and add the user to a group

  2. Great article! Very nice solution. There’s only one thing that didn’t work: if the user manually delete the drive map, after restart, the drive map will not appear. Do you know any way to force the reconnection?

  3. I do have an additional question. What if you want to push a network drive mapping, but it needs to be hidden?

Leave a Reply

Your email address will not be published. Required fields are marked *

  +  11  =  14