1

We're currently facing an issue where at some point between 12am & 5am every night all drive letters that weren't in use become mapped* and show up as disconnected on a Server 2008 R2 Terminal server.

We're unable to remove these mapped drives via the GUI or by command line using NET USE /delete and the only way for them to be removed is a restart. I've enabled object auditing for mapped drives to see if we can work out what's creating these but need to wait until tomorrow to check the logs.

We've ruled out GPOs & are ruling out scheduled tasks that are active in that time window by disabling them tonight (These have implications for LOB apps so we're unable to just run these).

Assuming we rule out the scheduled tasks tonight and all drives get mapped, anyone got any ideas on what could be causing this?

******The notes I've been given don't indicate where these mapped drives are pointing, will update tomorrow with the path (if any).*

Improve this question
4
  • 1
    So you're saying that if drives E and F are previously mapped that drives G through Z become "mapped", or something to that effect? - All previously unused drive letters become mapped?
    – joeqwerty
    Jul 19, 2013 at 5:16
  • Yeah that's essentially it. For example, we have A,B,C,D mapped already the next day E-Z will also be mapped but pointing to nowhere and saying disconnected. A-D will still work as normal and are unaffected.
    – Darren Mac
    Jul 19, 2013 at 7:11
  • Virus or Malware? Have you run a full scan? Also, It seems unlikey, but does anyone login during that time frame, perhaps a login script somewhere is going wrong?
    – GeoSword
    Jul 19, 2013 at 8:40
  • As far as I've been told the server was scanned with multiple apps and found nothing, has trend WFB Adv installed and fully up to date plus server performance hasn't been impacted at all so it doesn't look virus/malware related but I will be scanning myself tonight just to be sure though. Login scripts have all been checked and found nothing that could cause this, this affects all users regardless if they were logged in or logged in after these mapped drives appear.
    – Darren Mac
    Jul 19, 2013 at 11:04

1 Answer 1

Reset to default
0

Try this:

HKCU\Software\Microsoft\Windows\Current Version\Explorer\Mount Points

Remove all Network drives and reboot the server. That worked for me.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .