The Ghost Network Drive Finder: Hunting Down Missing Paths

PowerShell Get-PSDrive & Mapped Network Drive UNC Path Troubleshooting Guide

3 min. read

The Ticket: The Missing Z Drive

A user submits a ticket in a total panic because their "Z drive is completely gone" and they cannot access critical payroll files. When you ask them what server the drive maps to, they blink at you and say they have no idea, it is just the Z drive. Digging through Active Directory Group Policies or parsing through login scripts to find one specific map takes way too much time. We need a fast way to query the user's active session and see exactly where that ghost drive was pointing before it dropped off the map.

Pre-Flight Check

• Permissions: Standard user rights. This is incredibly important. You must run this command as the logged in user.
• Tools: PowerShell.
• Impact: Zero. This is a strictly read only query that makes no system modifications.

[!WARNING] The Risk Factor: The biggest trap here is not breaking the computer, but wasting your own time. If you open PowerShell as an Administrator to run this, the script will usually return empty. Windows User Account Control (UAC) isolates network drives between standard and elevated sessions. Always run this script as the standard user.

The Solution: The User Context Query

Taking a look at the script provided in image_01a8f6.png, there is a glaring syntax error that will trip you up. The command Rename-Property is not a standard built in PowerShell cmdlet. If you run that code as written, Windows will throw a giant red error.

To achieve the exact same result using native PowerShell, we need to use a calculated property within our Select-Object command. Save this corrected version or paste it directly into the terminal.

PowerShell

# *** 404 & More: The Ghost Network Drive Finder ***

Get-PSDrive -PSProvider FileSystem | 
Where-Object { $_.DisplayRoot -ne $null } | 
Select-Object Name, @{Name="NetworkPath";Expression={$_.DisplayRoot}} | 
Format-Table -AutoSize

The "Why" (Root Cause)

Windows handles network drives on a strict per user session basis. When a network connection blips or the client VPN drops for just a few seconds, Windows will sometimes unmap the drive visually from File Explorer. However, the operating system frequently retains the memory of the connection in the background. The user just sees a missing drive letter, but PowerShell can still see the underlying path.

Under the Hood (Technical Deep Dive)

We use the Get-PSDrive cmdlet and filter it strictly by the FileSystem provider. By default, Get-PSDrive shows local drives like your C drive, which have a blank DisplayRoot property. Mapped network drives populate that DisplayRoot property with the actual UNC path, like \\Server01\Accounting.

Our script filters out the blank local drives using Where-Object. Then, instead of relying on a fake cmdlet, we use a standard calculated property @{Name="NetworkPath";Expression={$_.DisplayRoot}} to cleanly rename the column header so it looks perfect on the screen.

RMM & Automation Tips

• The Execution Context: If you want to run this through your RMM platform, you must check your script execution settings. Most RMMs run scripts as the "SYSTEM" account by default. The SYSTEM account does not have any of the user's mapped drives. You must configure your RMM to execute this specific script as the "Logged on User" for it to pull the right data.

Troubleshooting & Edge Cases

• Edge Case 1: Registry Hunting. If the script returns absolutely nothing and you verified you are not running it as Admin, the drive mapping might have been completely wiped from the session. If that happens, you can manually check HKEY_CURRENT_USER\Network in the registry. Windows often leaves behind stale keys for old drive letters there.
• Edge Case 2: Legacy Net Use. If the drive was mapped using a very old legacy net use batch script without the persistent flag, it might not show up properly in modern WMI or CIM queries.

If you want to see more guides, scripts, and technical deep dives just like this, make sure to follow us on Twitter, check out our Facebook page, and sign up for the weekly 404 & More newsletter! ✌️