Looking for a particular mapped drive?

Content Authoring
1

I want to identify in relevance machines that have a specific mapped drive, based on its IP address…

I’ve had this work:
exists current user and (exists it whose (value “RemotePath” of it as string contains “128.268.40.111”) of keys of key “HKCU\Network” of registry)

That works only for “persistent” mappings because that’s where persistent mappings appear to be saved in registry…

Any trick to look for non-persistent mappings (login script type mappings) for a current user - I don’t want a list of them all, just true or false on a specific drive, by name or IP address…

Thanks !

2

I’m changing registry location and trying

exists key whose (name of it contains “64.44.35.174”) of key “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2” of registry

not sure this contains on persistent but it seems like a longer list !

3

Reminder that HKCU would only be the user running the client (most likely Local System) so if you wanted to check the hive of the current user you would need to use https://developer.bigfix.com/relevance/reference/logged-on-user.html#user-key-of-logged-on-user-registry-key which will give you the mapping into the HKU hive

4

None of this worked, all these reg entries seem to be for persistent drives only…
I ended up pushing a batch file to an open location (avoid permission issues) and running it with current user (old style with the runascurrent user.exe, the new switches don’t work as well for me and I get 70% exit codes 255 if I use them instead of the old exe)…

the batch file looks something like this:
Net use | find "64.44.35.174"
if “%errorlevel%”==“0” echo Found>c:\Mycookie.txt

and I search for that cookie in another job… Not as pretty but it did the job.

5

I seem to get entries in the MountPoints2 registry key for both persistent and non-persistent drive mappings (at least those made through Explorer). Not sure whether those mapped through ‘net use’ also show.