Mapped Network Drives are Not Showing in Elevated Programs


If you are using mapped network drives, you probably noticed that they are not showing in the apps running with administrator privileges (including cmd and PowerShell). The default User Account Control (UAC) settings don’t allow to access mapped network drives (via net use) from applications running in elevated mode (Run as administrator). This means that when you run the command prompt or a file manager (like Total Commander) with elevated privileges, they won’t display the drive letters of the mounted shared folders.

You may face such a problem if the following conditions are true:

  • Network drives are mapped in the user’s session (via GPO or manually via net use);
  • UAC is enabled on the computer (the GPO parameter User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode is set to default value “Prompt for credentials”);UAC GPO parameter - prompt for elevation
  • The current user has local administrator permissions on the computer and runs the app in the “Run as administrator” mode.

In this case, network drives are displayed in Windows File Explorer and in apps, but are not displayed in any applications running in elevated mode.

In this article we’ll show how to allow access to mapped network drives from the apps running in the elevated mode on Windows 10. This problem occurs both for network drives mapped through Group Policy and for the folders connected by users.

Important. It is strongly not recommended to completely disable UAC, even for a specific program.

Mapped Network Drives are not Showing in Windows Apps

Let’s check that you cannot access the mapped network drive connected in normal mode from an elevated application with UAC enabled. For example, let’s open a command prompt with user permissions and check if you can access the contents of the mapped network drive Z:.

Net use
Dir z:

The command should list the contents of the shared network folder.

Can't access mapped network folder from elevated cmd

If you open the command prompt in the current session as administrator, and try to access the same drive – you’ll receive the message that the path to the drive has not been found:

The system cannot find the path specified.

The system cannot find the path specified.

This behavior of Windows can cause some inconvenience when you frequently run applications in elevated mode. It is possible to run applications without administrator privileges, but this is not always applicable.

Why does it happen? This peculiarity is related to UAC mechanism for a user with the local administrator privileges. The matter is that when this user log in, two access tokens are created: the first token provides access with disabled administrator privileges (the filtered access token, with which most of the apps are running) and the second is the administrator token with full privileges in the system (all apps approved for elevation by UAC are running in this context).

You can use whoami /all command in two cmd.exe sessions (normal and elevated) of the same user and compare the current privileges, you can see that they are very different. The following table lists the differences in the security groups and current privileges in each session.

Normal user session Elevated user session
Security group  

Mandatory LabelMedium Mandatory Level                        Label            S-1-16-8192

Mandatory LabelHigh Mandatory Level                          Label            S-1-16-12288
Privileges SeLockMemoryPrivilege

SeMachineAccountPrivilege

SeShutdownPrivilege

SeChangeNotifyPrivilege

SeUndockPrivilege

SeIncreaseWorkingSetPrivilege

SeTimeZonePrivilege

SeLockMemoryPrivilege

SeIncreaseQuotaPrivilege

SeMachineAccountPrivilege

SeSecurityPrivilege

SeTakeOwnershipPrivilege

SeLoadDriverPrivilege

SeSystemProfilePrivilege

SeSystemtimePrivilege

SeProfileSingleProcessPrivilege

SeIncreaseBasePriorityPrivilege

SeCreatePagefilePrivilege

SeBackupPrivilege

SeRestorePrivilege

SeShutdownPrivilege

SeSystemEnvironmentPrivilege

SeChangeNotifyPrivilege

SeRemoteShutdownPrivilege

SeUndockPrivilege

SeManageVolumePrivilege

SeImpersonatePrivilege

SeCreateGlobalPrivilege

SeIncreaseWorkingSetPrivilege

SeTimeZonePrivilege

SeCreateSymbolicLinkPrivilege

SeDelegateSessionUserImpersonatePrivilege

different user privileges in the elevated and normal sessions

Applications under the same user may be run in two contexts when UAC enabled (privileged and unprivileged). When you map shared network folders, the system creates symbolic links (DosDevices) that store the drive letter mapping to the UNC paths. These links are associated with the current process access token and are not available to other tokens.

The reverse problem may also occur: when the user with administrator permissions on the computer is connecting network drives using the Group Policy logon scripts, scheduled tasks or SCCM jobs (which are running with elevated privileges), these drives are not visible to the user in File Explorer (unprivileged process).

As a workaround, you can mount network drives from the elevated command prompt using the commands: net use or rundll32 SHELL32.dll,SHHelpShortcuts_RunDLL Connect .

Enablelinkedconnections: Enabling Mapped Drives in the Elevated Apps

There is an easier solution. To implement it, you have to make some changes to the registry:

  1. Open the registry editor (regedit.exe);
  2. Go to the registry key HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem;
  3. Create a new parameter (DWORD type) with the name EnableLinkedConnections and the value 1 ;EnableLinkedConnections key in registry
    Tip. The same change can be done with a single command:reg add "HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionPoliciesSystem" /v "EnableLinkedConnections" /t REG_DWORD /d 0x00000001 /for with PowerShell:
    New-ItemProperty -Path 'HKLM:SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem' -Name EnableLinkedConnections -Value 1 -PropertyType 'DWord'
  4. Restart your computer (or restart the LanmanWorkstation service with the command: get-service LanmanWorkstation |Restart-Service –Force, and re-logon Windows).

After restarting the computer, make sure that the user can see the mapped network drives in programs running with admin rights. The reverse statement is true: all network drives mapped in the elevated mode will also be available in the unprivileged user session.

This works on all Windows versions starting from Vista to Windows 10/Windows Server 2019.

Access mapped network drive from elevated applications

How it works? After you enabled the EnableLinkedConnections registry parameter, LanmanWorkstation and LSA (lsass.exe) will check for a second access token associated to the session of the current user. If this token is found, the list of the mapped network drives will be copied from one token to another. Thus, the network drives mapped in the privileged mode will be visible in the normal mode, and vice versa.

Tip. As an alternative solution, you can create a symbolic link to the target shared network folder. For example, as follows:

mklink /D c:docs \dublin-fs1docs

You can access this drive in both normal and elevated mode. It should be noted that one of the drawbacks of this method is that you access the shared folder as a current user. It is impossible to use the account of another user as in the case of net use command.

After enabling the EnableLinkedConnections parameter, mapped drives will also become available from the Scheduled Tasks launched under the current user. If the task is run as LocalSystem or another user, the mapped network drives of the current user will be unavailable.





Source link

Mourad ELGORMA

Mourad ELGORMA

Fondateur de summarynetworks, passionné des nouvelles technologies et des métiers de Réseautique , Master en réseaux et système de télécommunications. ,j’ai affaire à Pascal, Delphi, Java, MATLAB, php …Connaissance du protocole TCP / IP, des applications Ethernet, des WLAN …Planification, installation et dépannage de problèmes de réseau informatique……Installez, configurez et dépannez les périphériques Cisco IOS. Surveillez les performances du réseau et isolez les défaillances du réseau. VLANs, protocoles de routage (RIPv2, EIGRP, OSPF.)…..Manipuler des systèmes embarqués (matériel et logiciel ex: Beaglebone Black)…Linux (Ubuntu, kali, serveur Mandriva Fedora, …). Microsoft (Windows, Windows Server 2003). ……Paquet tracer, GNS3, VMware Workstation, Virtual Box, Filezilla (client / serveur), EasyPhp, serveur Wamp,Le système de gestion WORDPRESS………Installation des caméras de surveillance ( technologie hikvision DVR………..). ,

Laisser un commentaire