This message was deleted.

No other agents like WEM?

Nope, no WEM or any other agents like that

any logon scripts via local polices in gpedit.msc ? if no logon scripts or drive mapping gpp's in gpos the only other thing it could be is WEM/Appsense enviroment manager config ect what about the users AD acount any logon scripts there?

Try sysmon and check if you find something in eventlog of sysmon. Procmon can also help?

No scripts configured on the user. It's a new user created for testing purposes. I've been through gpedit.msc and I do not find anything related to printers or login scripts or startup scripts

Does the domain user have a new profile, or is this existing profile? Is the domain user representative of the other users (i.e. this same thing happens to them as well)? Could it be a script within the user's registry (Run key)?

Try Autoruns from Sysinternals, look at the Logon Tab.

New profile is created today. However in the current isolated setup a local profile is created

“Anyone know of a way to find out where network printers come from?” < when a printer and a network card have a special hug... ;)

I'm not getting any wiser with AutoRuns, unfortunately. I cannot see anything out of the ordinary

Citrix Studio policies?

I haven't found any that maps printers

Loopback processing in place for the VDA? Under Computer / User policy -> Admin Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Remote Session Environment -> Start a program on connection. Is there a custom application there to map drives? No printers mapped vie GPP? Are there any scheduled tasks set to run at logon in user context that could map drives? Is there anything in the local security policy for a startup script for users (i.e. built into the image)?

Block inheritance on the OU with the server and currently one GPO configured which enables loopback processing. I have gone over the scheduled tasks and haven't found any custom/configured with scripts that would map printers. No GPP configured with printers. No local policies either.

Maybe Usrlogon.cmd in system32 folder?

Hmm...

Have seen this before, some people have strange ideas...

persistent or non persistent? make sure the print mappings don't exist on teh server natively...meaning an admin double clicked on a network printer and now there is an icon by default in the printer list. those all need to be deleted

Nothing in UsrLogon.cmd

you double checked user GPOs where the user account exists?

Yes and no. In the OU with the user account there is a GPO configured that maps printers. But I have loopback processing set to replace, so no GPOs should be carried over from the user OU

we all need better closure Kasper, can you make up a different solution for us all? 🙂

So do I

Desktop or Server OS?

Server OS 2012 R2

and these are all print server printers?

Yes, only network printers from the local printer server in the dutch office

gpresult /v would hopefully tell you if it was GP related...could stop the citrix print service to see if that prevents the mappings, or run through the citrix modeling wizard. Or try editing localhost file for the print server on that device and see if you get any timeouts upon userlogon

Thanks. I have a few things to try out tomorrow

I have seen this before with printers mapped by scripts called from the logon.bat script in the AD user object or in the default domain policy.