Logon Scripts (GPO) - How to prevent mapping of drives?

[dfinan]

Hi there,

 

I have a PC that is being added to our network which although being a part of the domain, can not have any access to any network drives. A logon script is applied by GPO (from somewhere) so that by default any member of the domain is mapped with drives 'X' and 'Y'.

 

Is there a way I can prevent an individual machine on the network picking up these drives? I tried researching the issue online but did't get far, as I believe that the GPO does not make a local copy of the script.

 

Any help would be greatly appreciated.

 

Many thanks,

Dan.

[caffrey]

Few ways you can do it for example run a script on that machine with net use /delete drive letter, or move the machine to it's own OU and run a different GPO etc.

[EmperorPeng]

A simple .bat file placed into C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup reversing the drive mapping should work.

[Davit2005]

How about something like this in the logon.bat file, test with a few test users

 

if "%COMPUTERNAME%"=="PC" GOTO END

 

## PLACE NORMAL DRIVE MAPPING SCRIPTS TO SHARED FOLDERS BELOW HERE

NET USE Z: \\SERVER\Share /PERSISTENT:NO

 

:END

 

Replace PC with the Computername, however this will not remove the home share for the user but you can try removing that if necessary.

[penfold]

We use Group Policy Prefences for deploying network drives and these can be targeted by by computer so you can apply it to just the one computer name. You can delete or add network drives.

 

You could either replace your existing script with GPP and specify the drives to mapp as long as the computer isn't "computername" or delete all drives if the computer = "computername"