Mapped drive will not go away

[MNJoe]

I have an XP pro box connected to a 2003 server with a mapped drive "Q:" . I
have checked the server for any logon scripts and there are none. I have
deleted the user on the server and remade the user I have deleted the user
off the xp machine and relogged in. I have tried to disconnect using the NET
USE Q: / delete, I have deleted the regkey
HKCU\software\microsoft\windows\current version\explorer\mountpoint2\##server
name#share name. IT JUST KEEPS COMING BACK. this thing will not go away!!!
any ideas would be greatly appreciated.

Thanks

 

[John John - MVP]

net use /persistent:no
net use * /delete /y

Will disconnect all network resources.

The persistent drives are recorded at:

HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Network\Persistent Connections

John

 

[MNJoe]

OK tried the 2 command lines below. persistent drives is now no and I deleted
all the drives. rebooted when the desktop came up I opened MY Computer and
at first it wasn't there then all of a sudden it came back. tried the delete
again and logged back in again and it popped back up. right clicked and
disconnected and rebooted and again it came back. Thinking about reformatting
drive and rebuilding it???

Thank you for your help

 

[Pegasus [MVP]]

Reformatting and rebuilding your PC for this sort of minor issue would be
equivalent to buying a new car when you have a flat tyre. You probably have
a script somewhere that performs the unwanted mapping function. Reboot in
Safe Mode with Networking, then see if the problem persists. If it does not
then it's definitely some script. To home in on the culprit, launch
msconfig.exe and carefully examine all tasks under the Startup tab.

 

[John John - MVP]

Some script, batch file or program is creating the drive. If you are
absolutely sure that none of it is comming from the domain controller
try SysInternals' Autoruns to see if you can find the culprit on the
local machine:

http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx
Autoruns for Windows

Does the registry key remain free of the persistent mapping? Also check
your Startup folders, its a very common place to put Net Use scripts.

John

 

[MNJoe]

OK rebooted into safe mode with networking, This will freak you out. I now
have 3 mapped drives where there was only 1. Did the net use * /delete /y and
it shows all the mapped drives and that they were deleted. rebooted in
safe/networking again and they came back. rebooted normally and just the Q:
drive shows up. rebooted in safe/networking and 3 drives show up. This is a
new user I just created which I put into a new group I just created on the
2003 server. I Now have 2 flat tires and the motor is going!!

 

[John John - MVP]

Look at your startup items. If you want to go in deeper you can use
Process Monitor to do real time monitoring or to bootlog the startup
process. Of course, I take it that you are certain that there is no
malware at play.

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
Process Monitor

John

 

[MNJoe]

FOUND IT!!!, used the monitor and found some network lines on the start up
script under the group policy on the server using IFMEMBER. It was spelled
IFMENBER. it was misspelled with a bunch of the lines. fixed that and all
seems well now.

Thank you very much.

 

[John John - MVP]

You're welcome. Looks like you didn't need to buy a new car because of
your flat tires...

John

 

[John]

No. He didn't need a big MF gun to kill a roach.

You're welcome. Looks like you didn't need to buy a new car because of
your flat tires...

John