UNC / Mapped drive path query fails from console

(imported topic written by JamesN91)

(if property “ProviderName” of it as string contains “=” then (substring after “=” of (property “Name” of it as string) & substring after “=” of (property “ProviderName” of it as string)) else nothing) of select objects(“Name,ProviderName from win32_LogicalDisk”)of WMI

In local debugger this relevance works perfect. I get back a list of mapped drives with path.

When I run through console across network I get errors in the web reports and no results.

I have a feeling it is because the debugger is running as my local user and the console runs it as system which has no drives mapped to it.

Is there a way around this issue so I can get a list of mapped drives from the bes client?

(imported comment written by rd6591)

My understanding is that your feeling is correct. With the added complication that mapped drives are tied to each user - i.e. you’ll get different results depending on which user you look at.

To check the current logged on user, this might work, based on the current user sticky in this forum (I haven’t tested it):

(name of it & “:” & value “RemotePath” of it as string) of keys of (keys(“Network”) of (key whose ((it = name of current user as lowercase OR it starts with name of current user as lowercase & “@” ) of (it as string as lowercase) of value “Logon User Name” of key “Software\Microsoft\Windows\CurrentVersion\Explorer” of it) of key “HKEY_USERS” of registry) )

You might want to extract the information from all users that have logged on rather than the current one…?

(imported comment written by JamesN91)

Reg keys in the above rel were not accurate per my enviroment.

I searched the reg for a combinations of information dealing with the mapped drive / path and did not find what I need.

How is xp storing the mapped drive info per user profile if not in reg?

(imported comment written by rd6591)

HKEY_CURRENT_USER/Network seems only to store persistent connections. If you manually map a drive on the command line with NET USE, you should see drives appear under this key.

Not sure how you would access non-persistent mappings. The only relevant key I can find is HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

(imported comment written by rd6591)

Could you run a VBS script with RunAsCurrentUser to get the information into a file and access it from there?

Something like this which writes the results in c:\drives.txt :

download http://0.0.0.0:52311/Uploads/9e1216a456aa8f6d162feef0fe52794bd32d7f85/RunAsCurrentUserexe.tmp

continue if {(size of it = 67002 AND sha1 of it = “9e1216a456aa8f6d162feef0fe52794bd32d7f85”) of file “RunAsCurrentUserexe.tmp” of folder “__Download”}

extract RunAsCurrentUserexe.tmp

delete __appendfile

delete c:\netuse.vbs

appendfile Option Explicit

appendfile Dim network, drives, i, fso, f

appendfile Set fso = CreateObject(“Scripting.FileSystemObject”)

appendfile Set network = CreateObject(“WScript.Network”)

appendfile set f = fso.CreateTextFile(“c:\drives.txt”,True)

appendfile Set drives = network.EnumNetworkDrives

appendfile for i = 0 To drives.Count - 1 Step 2

appendfile f.WriteLine drives.Item(i) & " " & drives.Item(i+1)

appendfile next

appendfile f.Close

copy __appendfile c:\netuse.vbs

delete __appendfile

wait __Download\RunAsCurrentUser.exe --w {pathname of (system folder)}\cscript c:\netuse.vbs

delete c:\netuse.vbs

(imported comment written by JamesN91)

rd

HKEY_CURRENT_USER/Network seems only to store persistent connections. If you manually map a drive on the command line with NET USE, you should see drives appear under this key.

Not sure how you would access non-persistent mappings. The only relevant key I can find is HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

No info under HKEY_CURRENT_USER/Network.

I see the key you referenced, but need to think on how to make that work.

(imported comment written by SystemAdmin)

We are in need of this data now and were wondering if there is any way to get this to work?

(imported comment written by amitkumsingh91)

Please try this for Mapped Drive Path through BigFix for Win 7 or Win XP

if Exists(value “RemotePath” of it as string) of keys of (keys(“Network”) of Keys of key “HKEY_USERS” of registry) then (name of it & “:” & value “RemotePath” of it as string) of keys of (keys(“Network”) of Keys of key “HKEY_USERS” of registry) else “Shared Drive Not Found”

(imported comment written by SystemAdmin)

@amitkumsingh - Thank you. This seems to pull back drives mapped manually or via a batch file, but for some reason not via vbscript. It’s a great start for us, so thanks again!