When the system establishes a redirected drive, it is stored on a per-user basis. Only the user himself can manipulate the redirected drive. The system keeps track of redirected drives based on the user's Logon Security Identifier (SID). The Logon SID is a unique identifier for the user's Logon Session. A single user can have multiple, simultaneous logon sessions on the system.
If a service is configured to run under a user account, the system will always create a new logon session for the user and then launch the service in that new logon session. Thus, the service cannot manipulate the drive mappings that are established within the user's other session(s).
Redirected Drives on Microsoft Windows NT and Microsoft Windows 2000
On Windows NT and on Windows 2000, drive letters are global to the system. All users on the system share the letters A-Z. Each user does not get their own set of drive letters. This means a user can access the redirected drives of another user if they have the appropriate security access.
If a user tries to redirect a drive letter that is used by another user (such as
WNetAddConnection2()), the error ERROR_ALREADY_ASSIGNED will be returned. Although the redirected drive is global to all users, only the user who established it can manipulate it. Another example is if a user tries to remove or query information on a redirected drive that was established by a different user. The
WNetGetConnection() function and the
WNetCancelConnection2() function will return the following error message:
If a user tries to enumerate the list of redirected drives through
WNetOpenEnum() and
WNetEnumResource(), the functions only list redirected drives that were established by that user. Drives that were redirected by other users will not be visible.
Windows NT File Manager and Windows NT Explorer can see all the redirected drives because they call the
GetDriveType() function on each drive, and they display an icon for each drive that is found. Windows NT File Manager and Windows NT Explorer create an icon for redirected drives that are created by all users because drive letters are global to the system. However, the interactive user cannot use Windows NT File Manager or Windows NT Explorer to disconnect the drive because the drive was created in a different logon session.
If a service that is running in the LocalSystem security context establishes a drive mapping, only that service or another process running in the LocalSystem account can call
WNetCancelConnection2() to disconnect the drive.
Note All processes that are running in the LocalSystem account are running in the same logon session.
Redirected Drives on Microsoft Windows XP
On Windows XP and on Microsoft Windows Server 2003, each logon session receives its own set of drive letters, A through Z. Therefore, redirected drives cannot be shared between processes that are running under different user accounts. Additionally, a service (or any process that is running in its own logon session) cannot access the drive letters that are established in a different logon session. However, drive letters that are mapped from a service that is running under the local System account are visible to all logon sessions.