Windows 2000 Group Policy Drive Letter Mapping

This article explains how Microsoft Windows 2000 establishes and enforces drive letter mappings using Group Policy logon scripts. Because Windows 2000 predates native Group Policy Preferences, administrators relied on centralized Group Policy Objects (GPOs) executing VBScript or batch files via the SYSVOL share during user authentication. Below is a breakdown of the architectural process, scripting methods, and enforcement controls used to ensure users receive consistent network drive assignments.

The Role of Group Policy Logon Scripts

Windows 2000 does not include the built-in "Group Policy Preferences" extension, which was introduced in later Windows Server versions. Instead, drive letter mappings are enforced using logon scripts assigned through standard Group Policy Objects.

Administrators configure these policies within the Active Directory Users and Computers console by navigating to: User Configuration -> Windows Settings -> Scripts (Logon/Logoff) -> Logon

When a policy is linked to an Active Directory container—such as an Organizational Unit (OU), Domain, or Site—the policy targets users residing within that scope.

Script Storage and Replication

Once a drive-mapping script is added to a GPO, it is stored in the domain's shared system volume (SYSVOL). The File Replication Service (FRS) replicates the script across all Domain Controllers in the domain.

The path follows this standard structure:
\\<Domain>\SYSVOL\<Domain>\Policies\<GUID>\User\Scripts\Logon

Storing the script within SYSVOL guarantees that regardless of which Domain Controller authenticates the client workstation, the script is locally accessible and up to date.

Execution During the Logon Sequence

When a user logs into a Windows 2000 Professional workstation, the local Group Policy engine processes the applied GPOs according to the standard hierarchy: Local, Site, Domain, and Organizational Unit (LSDOU).

  1. User Authentication: The client authenticates against a Domain Controller via Kerberos or NTLM.
  2. Policy Retrieval: The operating system identifies the user's distinguished name and queries Active Directory for associated GPOs.
  3. Script Execution: The Windows initialization process (userinit.exe) invokes the assigned script from the SYSVOL path. The execution occurs under the security context of the logging-in user, meaning the user must have appropriate network permissions (Share and NTFS) to access the target network resource.

Scripting Methods for Drive Mapping

Administrators primarily used two methods within the script files to bind letters to Universal Naming Convention (UNC) paths:

1. Windows Script Host (VBScript)

Windows 2000 natively supports the Windows Script Host (WSH). Using VBScript allows administrators to query existing drive mappings, remove conflicts, and map new paths programmatically:

Set objNetwork = CreateObject("WScript.Network")
On Error Resume Next
objNetwork.RemoveNetworkDrive "H:", True, True
objNetwork.MapNetworkDrive "H:", "\\ServerName\UserShare", False

2. Shell Scripts (Batch/Command Files)

Batch scripts utilize the net use utility to assign drives. While simpler, they require explicit flags to handle existing connections:

net use H: /delete /y
net use H: \\ServerName\UserShare /persistent:no

Setting persistence to "no" ensures that the operating system does not attempt to cache the drive mapping independently in the local registry, leaving total control of the mapping lifecycle to the Group Policy script.

Enforcement and Conflict Handling

To guarantee that drive letters are strictly enforced and not overwritten by previous sessions or manual user changes, administrators implement specific policy behaviors:

  • Session Cleanup: Scripts typically execute a disconnection command (e.g., RemoveNetworkDrive or net use /delete) prior to creating the new mapping. This prevents errors if a user manually assigned a conflicting drive letter during a prior session.
  • Run Logon Scripts Synchronously: By default, Windows 2000 executes logon scripts asynchronously to speed up the desktop loading time. Administrators can enforce script completion before the shell appears by enabling the Group Policy setting under Computer Configuration -> Administrative Templates -> System -> Logon -> Run logon scripts synchronously.
  • Restricting User Modifications: To prevent users from manually modifying or disconnecting enforced network drives, administrators pair logon scripts with interface restrictions found in User Configuration -> Administrative Templates -> Windows Explorer, such as the "Remove 'Map Network Drive' and 'Disconnect Network Drive'" policy.