I tried to create this because the volume key is not a constant but when it runs all of them just say not reported.
values “0x00000002” of keys “Drive Type” of keys of keys “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives” of registry
To get the parent key name you could do something like this.
(names of (keys whose (exists value “Drive Type” whose (it as string is “2” of it) of it) of key “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives” of registry) as string)
but as it says in the kb link you posted this will provide “Volume{GUID}”
Are you wanting the drive letter or the drive name?
OK - So you just want to know if it exists. Then you can use something like this…
(exists(keys whose (exists value “Drive Type” whose (it as string is “2” of it) of it) of key “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives” of registry))
An issue that you might have is that you’re looking in the HKCU key. That key may not exist at the time you try collecting the information.
I just want to make sure that I am not forgetting the need for a wild card or something when it comes to the Volume{64d3d110-f16f-11dd-99e2-806d6172696f} part of the registry?
Remember that the client runs as System so HKCU is different in the relevance debugger than it is from the client perspective.
This will get you the name of all the “Drives” keys anywhere in the HKEY_USERS hive followed by the “Drive Type” identifier:
Q: (name of it, value “Drive Type” of it) of keys whose (exists values “Drive Type” of it) of keys “Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives” of keys of key “HKEY_USERS” of registry