Creating a Drive Mapping GPO –

Map network drives with a Group Policy Preferences (GPP) Drive Maps item under User Configuration, targeted by security group. This replaces logon scripts (net use) and applies at every logon and background refresh.

Applies to: Windows Server 2016 and later domain controllers; Windows 10/11 domain-joined clients.

Audience: Help desk and systems administrators with rights to create and link GPOs.

Example used throughout: map S: to \\FS01\Shared\Finance for members of GG-Finance-Users.

Prerequisites

• Rights to create GPOs and link them to the target OU (Domain Admins, Group Policy Creator Owners, or delegated).
• Group Policy Management Console (GPMC) installed — on a DC, or via RSAT on a workstation.
• The share exists and is reachable by its UNC path (\\FS01\Shared\Finance). Use the FQDN or a DFS namespace path if clients span sites.
• Share and NTFS permissions grant the target group access. The GPO maps the drive; it does not grant access.
• A security group for the users who get the drive (e.g. GG-Finance-Users), with members populated.
• The OU that holds the user accounts is identified. Drive maps are a user setting, so link to a user OU, not a computer OU.

Naming convention: U - Drive Maps - <Dept or Scope> (e.g. U - Drive Maps - Finance). The U prefix flags a user-side GPO.

Step 1: Create and link the GPO

1. Open Group Policy Management (gpmc.msc).
2. Expand Forest > Domains > <your domain> and select the OU that holds the target user accounts.
3. Right-click the OU and choose Create a GPO in this domain, and Link it here…
4. Name it U - Drive Maps - Finance and click OK.
5. Optional: right-click the new GPO, open GPO Status, and choose Computer Configuration Settings Disabled. This skips the empty computer side and speeds processing.

To stage the GPO before it goes live, create it under Group Policy Objects first and link it after testing.

Step 2: Configure the Drive Map preference

1. Right-click the GPO and choose Edit.
2. Go to User Configuration > Preferences > Windows Settings > Drive Maps.
3. Right-click Drive Maps and choose New > Mapped Drive.
4. On the General tab, set the fields below.

5. Leave the Common tab open for Step 3, or click OK if no targeting is needed.

Step 3: Target by security group (item-level targeting)

Item-level targeting (ILT) lets one GPO hold many drive maps, each applied only to its own group.

1. In the drive map properties, open the Common tab.
2. Check Run in logged-on user’s security context (user policy option). This is required for user-specific shares and access-based enumeration.
3. Check Remove this item when it is no longer applied if the drive should disappear when a user leaves the group. This forces the Action to Replace.
4. Check Item-level targeting and click Targeting…
5. Choose New Item > Security Group, click …, and select GG-Finance-Users.
6. Leave User in group selected and click OK twice.

Repeat Steps 2–3 for each additional drive in the same GPO. For a drive every user gets (e.g. H: home), skip ILT and use %USERNAME% in the path: \\FS01\Home$\%USERNAME%.

Step 4: Scope and apply the policy

Leave Security Filtering as Authenticated Users when you use item-level targeting. ILT does the per-group filtering.

If you filter at the GPO level instead (one GPO per group):

1. Select the GPO, open the Scope tab, and add the group under Security Filtering.
2. Remove Authenticated Users from Security Filtering.
3. Open the Delegation tab, click Add, choose Domain Computers, and grant Read. Since MS16-072, computers must be able to read user GPOs or the policy silently fails.

Confirm the link is Enabled and that no higher-precedence GPO or Block Inheritance on a child OU stops it. Changes reach clients at next logon or within the 90–120 minute background refresh.

Verification and testing

Test with one user in the target group on one client before wide rollout.

1. On the client, signed in as the test user, run:

gpupdate /force

2. Sign out and back in (drive maps apply most reliably at logon).
3. Confirm the drive shows in File Explorer with the right letter and label, and opens.
4. Confirm the GPO applied:

gpresult /r /scope user

U - Drive Maps - Finance should be listed under Applied Group Policy Objects. For full detail, run gpresult /h C:\Temp\gp.html and open the report.

5. List current mappings:

net use

6. Test the negative case: sign in as a user not in the group and confirm no S: drive appears.

Troubleshooting

For deeper detail, check Event Viewer > Applications and Services Logs > Microsoft > Windows > GroupPolicy > Operational on the client.

Reference

Drive map actions