Partager via

Mapped drives can’t be created after Microsoft Security Update from code running under Network Service account

  • Article

Mapped drives can’t be created after Microsoft Security Update from code running under Network Service account

MS09-012: Description of the security update for Windows Service Isolation: April 2009 ( KB 956572 )

 

Possible scenario: You are using web application running under Network Service account and the code creates mapped drives using WNetAddConnection* APIs and fails stating ERROR_ALREADY_ASSIGNED error 85.

 

With this update installed on the machine, you will not be able to create mapped drive from the Network Service account. This is intentionally blocked for Network Service account.

Uninstalling the security update, Network Service account is able to create the mapped drive through WNetAddConnection* API successfully.

 

Verify if this is the case and options to workaround--

#1, If you have this issue, see if the update is installed on your machine. Check though Control Panel Installed Programs and updates or type “systeminfo” on command prompt.

#2, To make sure this is the issue, see if you can uninstall the update. If after uninstalling the update, if your code in Network Service is able to create the mapped drive, then security update was causing it to fail.

#3, Recommendation is, try using a different account to run the application which will make the application and security update to co-exist on the machine.

#4, else If it is not at all possible then try below registry change to revert back the changes of update in this regard.

Key- “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager”

                                ProtectionMode DWORD 0

 

Restart the machine to take it in effect.

 

Thanks.

 

Nitin Dhawan

Windows SDK - Microsoft