Network drives are not remembered in elevated mode
You can easily verify this when you open an administrative cmd. Net use will tell you that drives are "unavailable". our users are local administrators. This creates a problem for us when users manually install applications from network shares. e.g. install from S:\programs\adobe\reader\setup.exe will fail during install because the elevated mode cannot find S:. The workaround is to map the drives manually from an administrative command prompt before starting an installation, but this is far too heavy for most of our normal users. Are there any registry/GPO settings that can make elevated mode remember the users drives?
December 2nd, 2009 3:17pm

Wow, I hadn't noticed that before, but I just did confirm that it's happening here too, using Workgroup networking (no domain in my case), logged-in account being used to create the share at login. This could be a MAJOR headache in a corporate environment, where there are a lot of "standard"drive mappings.I suppose it's not really a surprise, as with UAC you're really a different "user" when elevated as when not elevated, and different users have never been able to see one anothers' drive mappings.I can't beginto see how this restriction enhances security in any way. I don't want to believe that such a basic thing has been missed by Microsoft, though...I thinkthe workaround mayhave to be just toturn off UAC, which is of course only viable for power-users and admins who know what they're doing. On the other hand you mention you're having the users install software themselves... Are you giving them admin privileges or access to a privileged account? I can't quite envision your policy.I thought that perhaps making the drive mapping using stored credentials might help, but nope, doesn't help.I even tried making the drive connection from an elevated Explorer window, but no dice seeing the files from an elevated command window later.Turning off UAC does indeed close up the gap as expected and make the mapped drive available to all apps.I think this one is a bona fide oversight or bug with UAC.-Noel
Free Windows Admin Tool Kit Click here and download it now
December 2nd, 2009 5:36pm

Upon a little more research, I have found what appears to be a better workaround: Enabling Linked Connections. [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]"EnableLinkedConnections"=dword:00000001From what I have read, the EnableLinkedConnections setting enables Windows to share network connections between the filtered access token and the full administrator access token for a member of the Administrators group.I tested it and it does work in Windows 7 Ultimate 32 bit... I don't know whether this can apply in your case, HAL07. It depends on whether your users are Adminsfor their own computers.On a quick scan in gpedit.msc I did not see a "legal" group policy entry that controls this. I believe this settingis unsupported by Microsoft.-Noel
December 2nd, 2009 6:45pm

thanks noel. by the way of course this lowers the security, as a virus elevated cannot reach network drives by default.
Free Windows Admin Tool Kit Click here and download it now
December 2nd, 2009 11:29pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics