Windows 10 Logon Script Mapped Drives

[kennysarmy]

Windows 10 build EDU 1607.

 

Came in this morning to test further and no mapped drives are appearing.

 

Weirdly the logon scripts that map the drives seem to run, but the drives just don't appear in File Explorer!

 

Any ideas?

[Steve21]

I'm assuming you have the 5 minute delay on scripts disabled?

 

Steve

[kennysarmy]

Weirdly the drives ARE mapped as if I drop to command prompt I can navigate all the mapped drives.

 

They are just not showing in File Explorer.

[Steve21]

Is this just as you as an admin? or normal users too?

 

If it's as an admin it might be due to the UAC issue they logged before about EnableLinkedConnections etc

 

Steve

[kennysarmy]

I'm assuming you have the 5 minute delay on scripts disabled?

 

Steve

 

I had n't because they drives had never not shown before :/

 

I'll make the GPO update and try again / test further....

[Michael]

You sure it's not DNS?

[kennysarmy]

You sure it's not DNS?

 

Don't think so as it's not affecting any Windows 7 Pc's.

 

The 5 mins group policy change has n't been entirely successful.

One test PC in my office, which I took off the domain and back on again - is now fine.

Another test PC which only had a gpupdate /force - still has no mapped drives, going to take that one on and off the domain now!

[kennysarmy]

Created a simple batch file on the desktop:

 

net use y: /delete

net use y: \\fp2\D$

pause

 

Works fine on Windows 7 computers!

 

On Windows 10 the batch file runs the same but the Y:\ drive is not shown in File Explorer

[Steve21]

As above Is this as you as an admin?

 

https://technet.microsoft.com/en-gb/library/ee844140(v=ws.10).aspx

 

Steve

[kennysarmy]

As above Is this as you as an admin?

 

https://technet.microsoft.com/en-gb/library/ee844140(v=ws.10).aspx

 

Steve

 

It does seem to be affecting domain admins and not our couple of test students...

 

I'll have a read of the link you posted - thanks.

[Michael]

You haven't applied the December 9th patch have you? It breaks DHCP, may explain why.

[kennysarmy]

You haven't applied the December 9th patch have you? It breaks DHCP, may explain why.

 

We're not experiencing any other issues....so if DHCP was broken would we not be getting other problems?

[kennysarmy]

I think it's to do with our AppLocker policy!

[kennysarmy]

 

Adding this highlighted rule in for the path = * has fixed the issue.

[kennysarmy]

I don't really get this if I'm honest as my executable rules look like this:

 

and staff/students can only run programs from the shared drive and domain admins can run exe's everywhere without a similar rule to that which I've had to add to the Script rules...

 

Why?

[SHimmer45]

i had this issue on a stand alone laptop when manually mapping drives, fine in command prompt not showing in Explorer..

weird issue on a surface running 10 pro 1607

[kennysarmy]

Well I still am having problems.....

 

My applocker policy for script rules looks like this:

 

 

Yet Domain Admins are prevented from running their logon batch files

 

 

Why?

 

I have a rule that says "CURRICULUM\Domain Admins" are allowed to run scripts from any path (I've put a "*" in the path)

[DavetheITguy]

Why don't you use Group Policy to map drives instead of scripts? They're much easier to manage.

[kennysarmy]

I've also checked that the local "Administrator" Group contains "Curriculum\Admin and Curriculum\Domain Admins" so that default rule in place should mean Domain Admins should never get locked out of anything

[kennysarmy]

Why don't you use Group Policy to map drives instead of scripts? They're much easier to manage.

 

It's something I will consider but I still don't understand why applocker is blocking batch files from running for domain admins, when as far as I can see - it should n't !

[DavetheITguy]

You've not set any local policies or site-wide policies that would stop batch files from running have you?

[kennysarmy]

You've not set any local policies or site-wide policies that would stop batch files from running have you?

 

No, nothing like that.

 

The only way I can get it to work is to change "staffnstudents" to "Everyone" - it's not quite what I wanted as I did n't want to have to keep specifying each separate location for "Domain Admins" to run scripts from, but if that's the only reliable way then so be it - at least it keeps things secure...

[MrMuppet]

It's something I will consider but I still don't understand why applocker is blocking batch files from running for domain admins, when as far as I can see - it should n't !

 

+1 for mapping home drives via GP instead of login script, much more reliable. In fact for our Windows 10 deployment, we got rid of the policy for mapping home drives and let AD handle it by setting it in the profile tab in the user's AD properties.

 

However that doesn't solve your issues running scripts. I had a similar issue where students were prevented from running their Visual Studio projects from their home drive despite there being a rule explicitly allowing students to run exe's from their home drive.

 

I assume in your 'Allow Domain Admins' script rule, you've got the path to the Netlogon folder.

 

As it's a batch script you've got, it's calling cmd.exe to process the commands so you may need to add an executable rule to allow domain admins to run all files as well (perhaps it's not picking up the fact that Domain Admins are a part of the Builtin Administrators group?). If you manually run the scripts on a Win 10 machine, does it produce that same error in the App Locker event log?

[kennysarmy]

+1 for mapping home drives via GP instead of login script, much more reliable. In fact for our Windows 10 deployment, we got rid of the policy for mapping home drives and let AD handle it by setting it in the profile tab in the user's AD properties.

 

However that doesn't solve your issues running scripts. I had a similar issue where students were prevented from running their Visual Studio projects from their home drive despite there being a rule explicitly allowing students to run exe's from their home drive.

 

I assume in your 'Allow Domain Admins' script rule, you've got the path to the Netlogon folder.

 

As it's a batch script you've got, it's calling cmd.exe to process the commands so you may need to add an executable rule to allow domain admins to run all files as well (perhaps it's not picking up the fact that Domain Admins are a part of the Builtin Administrators group?). If you manually run the scripts on a Win 10 machine, does it produce that same error in the App Locker event log?

 

In the Allow Domain Admins rule the path was the wildcard character "*" - as I wanted all paths to be allowed for all domain admins...and yes running the scripts manually created the same issue !

 

I've got a solution in place I think now...but I will look at GPP for scripts soon.

 

Cheers

[kennysarmy]

I've found that by creating a path rule for the specific DOMAIN ADMIN account it works!

 

This thread seems very similar:

https://social.technet.microsoft.com/Forums/windows/en-US/34a10cfe-d21b-45fc-8756-b5614eebd287/applocker-default-executable-allow-rule-for-administrators-doesnt-work?forum=w7itprosecurity