ERROR_IS_SUBSTED (0X00000087) – What It Means & How to Fix

Cause #1: The drive letter is already substituted or joined

This error trips up a lot of people the first time. You open Command Prompt, type SUBST X: C:\MyFolder, and boom — ERROR_IS_SUBSTED (0X00000087). Windows is telling you that drive X: is already assigned to something else via SUBST or JOIN. It doesn't matter if you can still see X: in File Explorer — it's reserved.

I've seen this happen most often when someone runs a batch script or a legacy app that uses SUBST, then forgets they already mapped the letter. Or maybe you had a temporary drive mapped weeks ago and it's still lurking in memory.

The fix: Unmap the existing substitution first, then re-apply yours.

1. Open Command Prompt as Administrator. Press Win+R, type cmd, then press Ctrl+Shift+Enter to run as admin.
2. Type SUBST X: /D (replace X with whatever drive letter you're targeting). This deletes the existing substitution for that letter.
3. Now try your SUBST command again: SUBST X: C:\MyFolder.

If the error persists, it's possible the substitution was done via JOIN instead of SUBST. In that case, use JOIN X: /D to remove it. Both commands use the /D flag to delete the mapping.

SUBST X: /D
JOIN X: /D

After this, your SUBST will work. I recommend verifying with SUBST alone (no arguments) to list all active mappings — that way you can see what's actually using the letter.

Cause #2: A leftover registry entry from a previous SUBST or JOIN

Sometimes SUBST and JOIN leave behind registry artifacts. This is rare, but I've seen it happen after a system restore or a clean boot that partially restored a drive map. The error code is the same — 0X00000087 — because the registry still holds the mapping even though the drive isn't visible in Explorer.

How to check:

1. Press Win+R, type regedit, and hit Enter.
2. Navigate to: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU. This stores recent SUBST and JOIN commands.
3. Look for any entry with your problematic drive letter (e.g., X:). Delete only that entry — don't touch anything else.
4. Close regedit, restart your PC, then try SUBST again.

Important: Don't mess with keys you don't understand. The MRU list is safe to clean because it's just a history of recent commands. If you delete the wrong thing, you might break your network drive shortcuts — but not the system itself.

If you're not comfortable with regedit, skip this and go to Cause #3's solution — the diskpart cleanup will nuke most leftover references anyway.

Cause #3: The drive letter is locked by a system process or a file handle

This one is trickier. Sometimes a running process, like a file explorer window or a background app, holds an open handle to the drive letter you're trying to substitute. When you run SUBST, it sees the letter as already occupied — even though no explicit SUBST or JOIN exists.

The real-world trigger: You've got a media player, a game launcher, or a cloud sync tool (like OneDrive or Dropbox) using that drive letter. Or you left a command prompt open that changed to that drive. Happens all the time.

Fix it with diskpart:

1. Open Command Prompt as Administrator.
2. Type diskpart and press Enter.
3. Inside diskpart, type list volume to see all volumes and their drive letters.
4. Find your target drive letter (e.g., X:).
5. Type select volume X (replace X with the volume number, not the letter).
6. Type remove letter=X (replace X with the drive letter). This forces the drive letter to be disassociated from any volume.
7. Type exit to quit diskpart.
8. Now try your SUBST command again.

diskpart
list volume
select volume 3
remove letter=X
exit

This method is aggressive — it removes the drive letter from the volume entirely. But that's fine, because you're about to reassign it via SUBST anyway. If you need the original volume back later, you can always reassign a letter to it in Disk Management.

Quick sanity check: Before resorting to diskpart, close all open windows and apps, then try SUBST again. Sometimes just killing Explorer.exe and restarting it (via Task Manager) clears the lock.

Quick-reference summary table

That's it. Most of the time, you'll only need the first fix. But if you're unlucky, work through the list — one of them will save your day. I know this error is infuriating, but it's also extremely predictable once you know the pattern.