GPO map drive policy failing to apply with Event ID 4098 - Error code 0x80070005 Access Denied

David Huber 20 Reputation points
2026-06-05T11:00:15.6333333+00:00

Hey sysadmins, I configured a Group Policy Preference to map a network share drive (Z:) for our accounting OU using Item-Level Targeting based on a security group. The policy hits the client machines, but the drive doesn't map. Event Viewer logs throw Event ID 4098 with error code 0x80070005 Access Denied. Users can manually navigate to the UNC path fine. What am I missing in the GPO context?

Windows for business | Windows Server | Directory services | Deploy group policy objects
0 comments

2 answers

Sort by: Newest
Most helpful Newest Oldest
  1. Harry Phan 30,960 Reputation points Independent Advisor
    2026-06-05T11:43:23.2566667+00:00

    Hi David,

    That access denied error happens because the drive map preference is running under the computer’s SYSTEM account instead of the user’s. In the preference item, open the Common tab and check “Run in logged-on user’s security context.” Make sure the GPO is linked to the OU with the user accounts, not just the computers, and that the Item-Level Targeting is scoped to the right security group. Once it runs in the user context, the mapping will succeed since users already have permissions to the UNC path.

    Let me know if you need further clarification.

    Harry.

    Was this answer helpful?

    0 comments

  2. AI answer

    2026-06-05T11:00:34.96+00:00

    The behavior matches a known limitation: certain Group Policy Preference items, including Scheduled Tasks and WMI/ILT-based items, do not run in the logged-on user’s security context even when configured that way, and instead run in the system context. When the preference (or its WMI/Item-Level Targeting) evaluates in the system context, access checks against user-scoped resources or permissions can fail with 0x80070005 (Access is denied), resulting in Event ID 4098 and the drive not being mapped.

    In this scenario:

    • The GPP Drive Map is configured with Item-Level Targeting based on a security group.
    • The preference processing and/or its WMI/ILT evaluation runs in the system context.
    • The system context does not have the same group membership or access as the user, so the targeting or the drive mapping fails with Access Denied, even though the user can manually access the UNC path.

    To resolve within the documented behavior:

    1. Avoid relying on user-specific context for this GPP item when it is evaluated in the system context.
    2. Adjust the targeting or security so that the system context does not encounter Access Denied (for example, by ensuring the required access is granted where the GPP item is evaluated), or redesign the mapping so it does not depend on conditions that only succeed in the user context.
    3. Use Group Policy logging/tracing for the relevant Client Side Extension (CSE) to confirm that the failure is due to the system-context evaluation and 0x80070005, similar to the documented Scheduled Tasks GPP behavior.

    References:

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.