Antivirus Causing Mapped Drives to Disappear? How to Fix It

Yes. Some antivirus/endpoint products and their network-protection features can cause mapped network drives to disappear by interfering with SMB traffic, isolating processes, or blocking credential pass-through. The steps below help you confirm whether an AV feature is responsible and apply minimal, reversible fixes; check the vendor documentation for your product and version before making permanent policy changes.

Symptom: what you see and when it happens

Observed behaviors:

• Mapped drives visible during a session but missing after sign-out/sign-in, lock/unlock, or reboot.

• Mappings work in a normal user shell but are not visible from an elevated shell (UAC elevation difference).

• Drives disappear immediately after an AV agent update or after a policy push from the AV management console.

• Mappings drop after network changes (Wi‑Fi reconnect, VPN connect/disconnect, domain controller failover) and do not reconnect automatically.

What to collect now (do these before changing AV settings):

• Record the exact time and timezone when a mapping disappears.

• From a normal Command Prompt, capture the mapping list:

net use

• From an elevated PowerShell, capture SMB mappings:

Get-SmbMapping

• Test reachability and SMB connectivity:

Test-Connection -ComputerName <server> -Count 3
Test-NetConnection -ComputerName <server> -Port 445

• Export relevant Event Viewer entries (System, Application) around the timestamp and the AV product logs for the same window.

Before you start (applicability, permissions and safety checks)

Scope and prerequisites:

• This guidance applies to Windows clients using SMB-mapped drives and to managed endpoint protection agents. Product behavior varies by vendor and version; check your vendor's documentation for version-specific instructions before changing policies.

• You need local administrator rights on the test machine to run elevated commands and to change local registry keys or service settings. Changing management-console policies requires the appropriate admin role in that console.

• Back out plan: record configuration and policy state before you change anything so you can restore settings.

Safe checks and stopping conditions:

• Do not uninstall or fully disable AV on production machines. If a test requires disabling protections, do it only on an isolated lab machine and restore protections immediately after the test.

• If mapped drives expose sensitive data, schedule tests during a maintenance window or on a non-production system.

How antivirus features can break mapped drives

Common AV behaviors that can break mappings:

• Network isolation or per-process sandboxing that routes or blocks network I/O for specific processes, causing those processes to lose access to the SMB share.

• SMB traffic blocking or inspection that drops or delays SMB packets and terminates sessions.

• Credential filtering, LSA hooks, or credential-provider interaction that prevents pass-through authentication from reaching the SMB stack.

• On-access scanning that introduces timing or file-handle conflicts over SMB and causes connections to fail.

• Driver or service start-order effects where the AV agent's behavior during boot or login prevents the OS from restoring mappings at the right time.

Safe diagnostic steps to confirm whether AV is responsible

Follow these steps, smallest-impact first, to diagnose without broadly disabling protection:

1. Reproduce and capture the failure on one test machine using the commands in the Symptom section.

2. Check elevated vs non-elevated visibility to rule out UAC linked-connection issues.

3. Inspect AV logs and the management console for entries at the recorded timestamps that mention network isolation, SMB blocks, quarantines, or policy changes.

4. Temporarily disable only the AV network-protection component or sandbox for the test machine (do not uninstall the client). Then attempt to re-map a share.

5. Map a test drive from an elevated session and from a normal session to compare results:

New-SmbMapping -LocalPath "Z:" -RemotePath "\\server\share" -Persistent $true
Get-SmbMapping

Expected diagnostic outcomes:

• If disabling the network feature restores the mapping and it survives sign-out/sign-in, the AV network feature is a likely cause.

• If nothing changes, revert the temporary change and proceed to collect logs for escalation.

Fixes and safe workarounds (step-by-step)

Apply the smallest, reversible change that fixes the symptom. Test each change on one machine before rolling out.

1. Use targeted exclusions in the AV product rather than broad disabling.

• Exclude the file server IP or subnet from network scanning.
• Exclude SMB ports (445, 139) from inspection if the AV supports port-based exceptions.
• Exclude specific UNC paths or the processes that require access (for example, explorer.exe).

2. If the issue is UAC/elevation visibility, enable linked connections on Windows on the test machine:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections

• Create a DWORD value named EnableLinkedConnections and set it to 1. Reboot and retest.

3. If credential filtering or LSA hooks are implicated, work with the AV vendor to allow the SMB/LSA interaction or to supply a documented exclusion. Do not disable credential-protection features without vendor guidance.

4. Avoid race conditions by restoring mappings after the network is available rather than at immediate logon:

• Deploy mappings via Group Policy Preferences (GPP), a logon script that checks network availability, or a scheduled task configured to run at logon with the option to start only if a network connection is available.

5. If driver or startup ordering looks causal, use a delayed mapping task that waits for network readiness instead of changing AV driver behavior.

What to do if a targeted change fixes the problem:

1. Re-enable any temporarily disabled AV features.
2. Keep only the minimal exclusion or configuration change that fixed the issue.
3. Document the change in change management and in the AV policy templates.

How to verify the fix worked

Verification sequence:

1. Reproduce the original trigger(s): sign out and sign in, lock/unlock, reboot, and run the AV agent update cycle if that was the original trigger.

2. Immediately check mappings from both normal and elevated shells:

net use

Get-SmbMapping

Expected output:

• The mapped drive appears in net use and in Get-SmbMapping and remains after the session or reboot.

3. Confirm Event Viewer no longer shows the earlier error around the test timestamps and that the AV product logs do not show blocking or isolation events for the mapping.

4. Optionally, run an automated sign-in test on a lab machine to verify persistence across several reboots.

Preventing recurrence and operational controls

Steps to reduce regressions:

• Centralize mapping deployment with Group Policy Preferences or coordinated provisioning scripts that run after the network is available.

• Record AV exclusions and mapping configuration in your change-management system so future AV policy updates include them.

• Add validation steps to the AV-policy update process: test policies on a pilot group that includes systems using mapped drives.

• Maintain an inventory of endpoint agent versions and check vendor release notes for fixes related to SMB or credential handling before upgrades.

What to collect before contacting vendor support

Collect these items to speed troubleshooting:

• Time(s) and timezone when mappings disappeared.

• Exact product name and version of the endpoint agent and management server.

• Export of local logs: Event Viewer (System, Application) and the AV client's logs covering the same timestamps.

• Command output saved to a text file: net use, Get-SmbMapping, Test-NetConnection results.

• A short, repeatable reproduction sequence and information whether the issue occurs on multiple machines or only one.

• Any temporary change you tested and its effect.

When you contact the vendor, ask whether known bugs affect drive persistence for your agent version, whether a hotfix or policy template exists, and for documented guidance to exclude SMB traffic or preserve credential pass-through without disabling protections.

Conclusion

Start by capturing the failure and testing with the smallest-impact change (disable only the AV network feature on a test host). If a targeted exclusion or timing change fixes the issue, keep the change minimal and document it. If not, gather the logs and reproduction steps above and escalate to the AV vendor or your security team.