Storage & Permissions

Windows UAC Mapped Drive Isolation & EnableLinkedConnections

Why network drives mapped in elevated admin prompts vanish from Windows Explorer, and how EnableLinkedConnections links them.

Read it offline, in your terminal:n -h uac-shares

The Problem

When you run PowerShell or Command Prompt as Administrator and map a network drive (e.g. net use Z: \\server\share), the drive connects successfully in the console, but is completely invisible in Windows Explorer.

Conversely, if you map Z: in Windows Explorer, elevated installers, backup tools, and administrative scripts report that drive Z: does not exist!

The Architectural Cause (Microsoft KB303520)

Under Windows User Account Control (UAC), an administrator account is issued two separate logon sessions (LUIDs) upon login:

1. Standard User Token: Runs Windows Explorer, web browsers, and normal desktop applications.

2. Elevated Administrator Token: Runs elevated PowerShell/CMD windows and installers ("Run as Administrator").

In the Windows NT Object Manager, drive letter mappings (DosDevices) are created within session-specific namespaces, not globally. Because the Standard token and Elevated token have different LUIDs, drive mappings created in one session are isolated from the other session.

❗ Critical Architecture Rule

This is intentional Windows security architecture designed to prevent unprivileged standard applications from hijacking network credentials or drive letters mapped with high-privilege credentials.

The Kernel Remediation: EnableLinkedConnections

Microsoft created a registry DWORD toggle specifically to instruct the LanmanWorkstation network redirector driver to share and mirror mapped drives between both the filtered and elevated tokens.

PowerShell One-Liner (Run as Administrator):

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLinkedConnections" -Value 1 -Type DWord

Command Prompt (Admin CMD):

reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLinkedConnections /t REG_DWORD /d 1 /f

💡 Pro-Tip

A Windows reboot or sign-out/sign-in is required for the kernel to initialize the linked session token mapping.

Verification with Netscrew

Run n shares or n sys. Netscrew directly queries this registry key and verifies whether EnableLinkedConnections is active.