Chapter 18 – Drive Mapping with Group Policy Preferences

-

 Windows Server Group Policy (GPO) Master Handbook

Chapter 18 – Drive Mapping with Group Policy Preferences

Learning Objectives

Deploy and manage mapped network drives using Group Policy Preferences (GPP), security groups, DFS Namespaces, and Item-Level Targeting.

1. Overview

Drive Mapping automatically connects users to shared folders when they sign in. Group Policy Preferences (GPP) provides flexible deployment without logon scripts.

2. GPO Path

User Configuration → Preferences → Windows Settings → Drive Maps

3. Drive Map Actions

Create (new only), Replace (delete/recreate), Update (modify existing), Delete (remove mapping). Update is recommended for most production environments.

4. Configure a Drive Map

Specify Action, Location (UNC path), Drive Letter, Label, Reconnect option, and run in user's security context.

5. Item-Level Targeting (ILT)

Use ILT to map drives based on security group membership, OU, IP range, computer name, operating system, laptop/desktop type, or registry values.

6. Security Group Mapping

Example: Map H: to \\FS01\HR only for the HR security group, and F: to \\FS01\Finance only for Finance users.

7. DFS Namespace

Use DFS paths such as \\company.local\Shares\Documents instead of server names to simplify migrations and improve availability.

8. Permissions

Drive mapping does not grant access by itself. Configure both Share and NTFS permissions correctly on the file server.

9. PowerShell & Verification

gpupdate /force, gpresult /h report.html, Get-SmbMapping, net use, Test-Path \\server\share

10. Troubleshooting

Verify UNC path accessibility, DNS resolution, SMB connectivity, share/NTFS permissions, Item-Level Targeting conditions, and review Group Policy operational logs.

11. Best Practices

Use DFS Namespaces, descriptive drive labels, Update action, security groups instead of individual users, and document all drive mappings.

12. Enterprise Scenario

A company maps H: for Home folders, S: for Shared Data, and D: for Department shares using security groups and DFS Namespaces across multiple branch offices.

13. Interview Questions

What is the difference between Create and Update actions? Why use Group Policy Preferences instead of logon scripts? What is Item-Level Targeting?

14. Practical Lab

Create a shared folder, configure permissions, create a Drive Maps preference, target a security group, run gpupdate /force, sign in as a test user, and verify the mapped drive.

Drive Mapping Reference

Setting

Recommended

Notes

Action

Update

Preferred for production

Reconnect

Enabled

Persistent mapping

Drive Letter

Organization standard

Avoid conflicts

UNC Path

Use DFS Namespace

High availability

ILT

Security Groups

Granular targeting

Run in user's context

Enabled

Access with user credentials

Labels

Meaningful names

Easy identification

Microsoft Learn References

Group Policy Preferences

Distributed File System (DFS)

SMB File Shares

Comments

Post a Comment

Popular posts from this blog

IIS Installation and Application configuration windows swerver

-
Image
  1.      Using the Server Manager, select  2 Add roles and features . Figure 4-9 Server Manager – Adding Roles and Features Select  Role-based or feature-based installation , and then click  Next . Choose  Select a server from the server pool . 4.      Select the server you are configuring, and then click  Next . Figure 4-10 Server Manager – Select Server 5.      Expand the  Web Server  role service. Figure 4-11 Server Manager – Web Server Role Services Expand the  Web Server  options and select the following  Common HTTP Features : ·         Default Document ·         ·         HTTP Errors ·         ·         Static Content · ...
Read more

IIS Self Signed

-
Image
  Securing the server with SSL Now we want to secure the cats by adding a SSL certificate to our Server. In your IIS Manager go to your server (The top of the tree to the left)  ➜  Scroll down and double-click Server Certificates. (If your self-signed certificate is already here, jump ahead to the bindings steps) We need to import our self-signed server certificate in order to enable https communication with SSL, so click Import… Click the … and find your .pfx file, fill out the password (the -po parameter in your command batch file) and click OK Your certificate is now added Double-click the newly added cert to verify that it is trusted (Your self-signed certificates were added to the correct stores in my previous post, so again: read it if you are lost right now ;-)) So far, so good! Now we can add the https binding, the same way as before but choose https with port 443, your domain as the host name and find yourself signed certificate in the drop do...
Read more

Here’s a step-by-step guide on configuring WDS on Windows Server

-
Windows Deployment Services (WDS) is a Microsoft tool for network-based installation of Windows operating systems. It enables administrators to deploy Windows images over a network to computers without requiring physical media. Here’s a step-by-step guide on configuring WDS on Windows Server: Prerequisites: A Windows Server machine with WDS role installed. Active Directory, DNS, and DHCP set up and running on the network. An NTFS partition on the server to store images. Step 1: Install WDS Role Open Server Manager and go to Manage > Add Roles and Features . Click Next until you reach the Server Roles page. Select Windows Deployment Services and click Next . Choose WDS Deployment Server and WDS Transport Server and click Next . Complete the wizard to install the role, then restart the server if prompted. Step 2: Configure Windows Deployment Services Open WDS by navigating to Server Manager > Tools > Windows Deployment Services . In the WDS console, right-click on your se...
Read more