By itself, a network drive is connected, where to dig?

Question

Network administration

Domain structure. The GPO specifies a mapping of disks and all domain users who have passed the check automatically receive a shared disk, which is mapped as "L" for everyone.
But recently, first at one, and a month later, suddenly at another employee, this same ball itself began to be duplicated as a "Z" disk.
Where to dig, where to look? No login scripts are executed.

Answer 1

maybe he's from the government?
and what happens if it already has L ?