Understanding Error 86 in Network Mappings
Error 86 is formally defined as "The specified network password is not correct." When you attempt to map a network drive for all users, especially via scripts or Group Policy Objects (GPO), this error appears if the username or password provided does not match what the server expects. This is particularly common in domain environments where the user context might be ambiguous, such as when using local accounts to access domain resources or vice versa.
The issue often arises because the system attempts to use the currently logged-in user's credentials automatically, but the share requires specific service account credentials. Alternatively, the password may have expired, or there could be a mismatch in the domain name format used in the script. Understanding these root causes is essential before proceeding with fixes.
Clearing Stale Credentials
The most immediate step to resolve Error 86 is to clear any cached credentials that might be causing conflicts. Windows stores network credentials in the Credential Manager, and old or incorrect entries can interfere with new mapping attempts. To fix this, open the Control Panel and navigate to User Accounts, then select Credential Manager. Under the Windows Credentials tab, look for any entries related to the target file server or IP address. Remove these entries to force the system to prompt for fresh authentication or to allow the script to provide correct credentials without interference.
After clearing the cache, restart the computer to ensure that any lingering session tokens are fully flushed. This simple action often resolves persistent authentication errors that occur despite having the correct password entered in your script.
Correcting Script Syntax and Context
If you are using a logon script or PowerShell to map drives for all users, the syntax must explicitly define the domain and user context. Using wmic netuse or PowerShell’s New-PSDrive cmdlet requires careful attention to the -Credential parameter. For example, when using PowerShell, ensure you are passing a PSCredential object rather than just a string. If you are using batch scripts, the net use command should include the domain prefix in the username, formatted as DOMAIN\Username.
It is also critical to run these scripts in the correct execution context. If the script runs under the SYSTEM account but tries to map a drive for a user, it may fail unless configured correctly. Conversely, if it runs under a user context, ensure that the user has permission to access the share. Refer to Checking Active Network Shares within a Domain using PowerShell Script for best practices on scripting secure and reliable drive mappings.
Configuring Group Policy for All Users
For enterprise environments, applying network mappings via Group Policy is more scalable than individual scripts. Open the Group Policy Management Console and edit the relevant GPO linked to the user or computer container. Navigate to User Configuration > Preferences > Windows Settings > Drive Maps. Here, you can create a new mapped drive entry. Crucially, check the box for "Reconnect" and ensure the "Use the following connection settings" option is selected if you need to specify different credentials. If the share requires a specific service account, you must enter those credentials in the respective fields within the GPO editor. Note that GPO preferences do not support storing passwords in plain text for security reasons; instead, they rely on the current user's context or require additional configuration for service accounts.
Troubleshooting Authentication Conflicts
If the above steps do not resolve the issue, consider potential authentication conflicts between local and domain accounts. This is a common scenario when accessing NAS devices or mixed-environment shares. Ensure that the account being used exists in both the local machine database and the domain, if applicable. Sometimes, renaming the local administrator account or disabling unnecessary local accounts can prevent confusion during the authentication handshake. Additionally, verify that the time synchronization between the client and the server is accurate, as Kerberos authentication will fail if the time difference exceeds five minutes. For more insights on handling local account logins to network resources, see Local account trying to login to a NAS, without asking.
Frequently Asked Questions
Why does Error 86 appear only for some users?
This usually happens because those specific users have stale credentials cached locally or lack permissions to the target share. Clearing their individual credential caches often resolves the discrepancy.
Can I use a service account for all user drive mappings?
Yes, but you must configure the GPO or script to use that specific account's credentials explicitly. However, this approach reduces auditability since multiple users share one identity for file access.
How do I fix Error 86 on Windows Server 2016 specifically?
On Server 2016, ensure that SMB 1.0 is disabled if possible, as it can cause negotiation failures. Also, verify that the latest cumulative updates are installed, as Microsoft frequently patches authentication bugs.
What is the difference between Error 86 and Error 5?
Error 86 indicates an incorrect password or credential mismatch, while Error 5 typically means "Access Denied" due to insufficient permissions. Check your event viewer logs to distinguish between authentication failures and authorization denials.
Is it safe to store passwords in plain text in logon scripts?
No, storing passwords in plain text is a significant security risk. Use encrypted credential files or integrated Windows Authentication whenever possible to protect sensitive information.