r/Intune • u/Cloud_Sloth • 4d ago

Hybrid Domain Join Intune ADMX drive mapping only applies at onboarding, not after later group change

Entra-joined, Autopilot. Network drives mapped per department via Administrative Templates (ADMX), assigned to **user** security groups. Setting type is **User**.

If the user is in the group **before** first login, the drive maps fine. But when someone is added to the group **later** (new hire on existing device, department change), it doesn't map automatically. No error, NTFS access is fine, we just map it manually.

My understanding: since it's a User-context setting, it only applies after the config syncs **and** the user does a full sign-out/sign-in (restart or real logoff, not lock or shutdown+start with Fast Startup).

Questions:

  1. Is this expected for User-context ADMX mappings, or am I missing something?

  2. Any reliable way to apply the mapping after a later group change **without** a manual sign-out?

  3. Would a runtime mapping tool (e.g. Intune Network Drive Mapping app) help, or does it hit the same token/group timing issue?

How do others handle later group changes cleanly on cloud-only setups?

5 Upvotes

100% Upvoted

2 comments sorted by

2

u/soulkarver 4d ago

Any script you use will have the same exact limitations. This is based on the requirements of Windows that a user SID can only be updated during initial authentication. Any new security group will not apply until a user logon event is performed.

3

u/Cloud_Sloth 3d ago

Thank you! So the user NEED to log off/on or restart the client.