Disconnect Specified Mapped Drives for All Users On All Systems

This worklet will disconnect all mapped drives specified by $removeDrives in the evaluation and remediation. Be sure to set $removeDrives identically in both. The drives will not appear disconnected until after a reboot. Details of the user and drives disconnected will appear in the activity log.

Evaluation:

<#
.SYNOPSIS
    Delete Specified Mapped Drives for All Users on a System
    OS Support: Windows 7 and above
    Powershell: 2.0 and above
    Run Type: Evaluation
.DESCRIPTION
    This worklet is designed to search for any mapped drives specified with $remoteDrives, and disconnect them. If any setting is found to be non-compliant, the evaluation script will close with an
    exit code of '1' to trigger remediation.  $removeDrives needs to be set the same for evaluation and remediation to work correctly.  If drives are found and disconnected, the drives will not appear disconnected until after a reboot.
    To use this worklet, add the desired parameters to the $removeDrives line at the top of this script.
.NOTES
    Author: twiese
    Date: May 27, 2021
#>

# Define mapped drives to disconnect
$removeDrives = @("Y","Z")
# ----------------------------------

# Get User details including SID
$users = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount = 'True'"

# Add HKEY_USERS to a PSDrive for easy access later
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS -ErrorAction SilentlyContinue | Out-Null

# Loop through the list of users to check each for matching drives to disconnect and exit when first one is found
Foreach ($user in $users) {

    # Retrieve SIDs for each user
    $sid = $user.SID
    $name = $user.Name
    
    # Load Registries for users, if ntuser.dat exists
    # this prevents us from attempting to load Administrator and similar accounts
    
    if (Test-Path "C:\Users\$name\ntuser.dat") {
        
        # Load user's ntuser.dat into the registry
        & reg load "HKU\$sid" "C:\Users\$name\ntuser.dat" | Out-Null
        
        # Get mapped drives for user and see if any match drives to be removed
        $drives = (Get-ChildItem -Path HKU:\$sid\Network | Get-ItemProperty).PSChildName
        $matches = $removeDrives | Where-Object { $drives -contains $_ }

        # If any user has a matching drive, immediately clean-up PSDrive and exit for remediation without checking for further matches
        If ($matches) {
                Remove-PSDrive -Name HKU
                Exit 1
        }
    }
}

# Clean-up the PSDrive if no results
Remove-PSDrive -Name HKU
Exit 0

Remediation:

<#
.SYNOPSIS
    Delete Specified Mapped Drives for All Users on a System
    OS Support: Windows 7 and above
    Powershell: 2.0 and above
    Run Type: Remediation
.DESCRIPTION
    This worklet is designed to search for any mapped drives specified with $remoteDrives, and disconnect them. If any setting is found to be non-compliant, the evaluation script will close with an
    exit code of '1' to trigger remediation.  $removeDrives needs to be set the same for evaluation and remediation to work correctly.  If drives are found and disconnected, the drives will not appear disconnected until after a reboot.
    To use this worklet, add the desired parameters to the $removeDrives line at the top of this script.
.NOTES
    Author: twiese
    Date: May 27, 2021
#>

# Define mapped drives to disconnect
$removeDrives = @("Y","Z")
# ----------------------------------

# Get Users details including SID
$users = Get-WmiObject -Class Win32_UserAccount -Filter "LocalAccount = 'True'"

# Add HKEY_USERS to a PSDrive for easy access later
New-PSDrive -PSProvider Registry -Name HKU -Root HKEY_USERS -ErrorAction SilentlyContinue | Out-Null

# Loop through the list of users to check each for matching drives to disconnect
Foreach ($user in $users) {

    # Retrieve SIDs for each user
    $sid = $user.SID
    $name = $user.Name

    # Load Registries for users, if ntuser.dat exists
    # this prevents us from attempting to load Administrator and similar accounts

    If (Test-Path "C:\Users\$name\ntuser.dat") {

        # Load user's ntuser.dat into the registry
        & reg load "HKU\$sid" "C:\Users\$name\ntuser.dat" | Out-Null
        
        # Get mapped drives for user and see if any match drives to be removed
        $drives = (Get-ChildItem -Path HKU:\$sid\Network | Get-ItemProperty).PSChildName
        $matches = $removeDrives | Where-Object { $drives -contains $_ }
        
        # If any mapped drives match ones to be disconnected, disconnect them
        If ($matches) {
            ForEach ($match in $matches) {
                Try {
                    Remove-Item "HKU:\$sid\Network\$match"
                    Write-Output "User: $name, drive $match disconnected.  "
                    
                } Catch {
                    Write-Output "User: $name, drive $match couldn't be disconnected.  "
                }
            }
        }
    }
}

# Clean-up the PSDrive
Remove-PSDrive -Name HKU