Removing drive maps when group membership changes

[OllyM]

Hi all

 

We have a handful of group policies. Each assigns a mapped drive (and a few other user bits) and the GPO is restricted to a group membership. This all works fine, however when the user is removed from the group membership the drive map remains. As the share is restricted to the same group membership, the drive map itself isn't accessible, which is good. However it looks scrappy.

 

The drive map GPO is set to remove when the user falls out of context, but I guess that doesn't take in to account being in the same OU but not in the security group.

 

Any ideas how I can have the users drive map removed when they aren't in the correct membership? I thought about a top level GPO to remove all drive maps, but I'm unsure as to the order of precedence that would take affect.

 

Olly

[MatthewL]

I use to map mine via script so always set it to delete all drives before mapping new ones. It's a good point, maybe on your default user policy set it to delete all before applying new ones?

[snagrat]

Item level targeting would help here.

 

Drives could be mapped per group in an OU rather than per OU

[OllyM]

Snagrat, That's what we are doing, if I understand you correctly. We have one OU (in this instance) with lots of users, each users is in one or more groups, those groups have APPLY permissions on a series of GPOs assigned to that OU.

[snagrat]

No that doesn't sound like Item Level targeting.

 

http://www.dell.com/support/article/us/en/04/sln285439/windows-server--using-item-level-targeting-with-group-policy-preferences?lang=en

[free780]

Remove this item when it is no longer applied ? On the drive map settings?

[OllyM]

Nope. Doesn't appear to.

 

If I remove the user from the which which has "apply" access to the GPO, the drive letter remains. As the group is also used to give security and share permission to the shared folder they can't access anything, but dept heads are annoyed that they "know things are there but can't access them".

 

I kinda see their point.

 

I'm tempted to whack in a login script higher up the OU tree to remove all drives, but I can't believe that there isn't a neat answer to this.

 

Olly

[free780]

Could have a drive map with remove with targeting if NOT in "Group Name".

[TechMonkey]

The first drive map on the highest User OU is to remove all drive mappings after I. This way they are always up-to-date, no old mappings are accidentally left and if anyone moves group they are dealt with.

[Rob_D]

The first drive map on the highest User OU is to remove all drive mappings after I. This way they are always up-to-date, no old mappings are accidentally left and if anyone moves group they are dealt with.

 

This is what I do for drives and printers. First item in the GPO removes all previous mappings, then the required ones are created.