I am using susbst.exe to bind virtual drive letter to specific directory. Recently I found some really strange behavior.
When I try to apply NTFS encryption on a file using the actual file path everything is OK. But when i substitute the directory with the drive letter i have binded it with, the following error occurs “The System can not find the path specified.”. In windows events the error is logged as follows:
Source: EFS EventID: 6022 "Cannot Create\Open System Volume Information directory.
"
As far as I can see this is an issue of subst.exe and lsass.exe
I have checked with process monitor in both cases(successful and not ) and they are exactly the same. the file paths for all the IRPs are what they have to be, and everything returns success. The whole sequence of IRPs and results is totally identical. My question is if someone knows why is this happening, perhaps if there is some registry setting to fix it.
Or may be a specific IRP that needs to be handled in some way?