Solved

Determine what drives are persistently mapped and read that info into log file

Posted on 2006-10-31
8
473 Views
Last Modified: 2007-12-19
Is there a way to do this in vbscript maybe and run through a login script?  I'm trying to determine what drives are mapped persistent as we are getting greater control on the environment.  I re did the login script and want to disconnect all drives before mapping but want to see if there are any drives that are persistenly mapped so I can route accordingly..  Thanks
0
Comment
Question by:rtmcmullen
  • 5
  • 3
8 Comments
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17847883
Only way I can think of is from the registry keys that store them - net use doesn't differentiate afaik.

Can't check to give you the key at the moment because I'm not on a windows machine (well windows mobile but that doesn't count)

No doubt someone else will post the key, otherwise will look back when on Windows later (or search for a share name you know is persistently mapped in regedit)

Steve
0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17847912
OK here are the key details:

http://www.winguides.com/registry/display.php/200/

and details of how to extract registry keys in VBS:

http://www.codeproject.com/books/1578701392.asp
0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17848458
Actually on the box I am on at the moment the entry as shown above doesn't appear to eb right.  Try

HKEY_CURRENT_USER\Network

under which you get a key for each drive letter then entries for RemotePath

e.g. you can read the path for the X: drive mapping with

oShell.RegRead ("HKCU\Network\X\RemotePath")

0
 

Author Comment

by:rtmcmullen
ID: 17849652
Ok, I have this which is reading it into excel, but it is reading the first drive 3 times:

' List persistent drive mappings
'Wscript.Echo oDrives.Count / 2, "Network Connections"
For ix = 0 To oDrives.Count - 2 Step 2
    sDrive = oDrives(ix)
    sUNCPath = oDrives(ix+1)
    If sDrive = "" Then sDrive = "--"
    ws.Cells(2,36).value = sDrive & " = " & sUNCPath
      ws.Cells(2,37).value = sDrive & " = " & sUNCPath
      ws.Cells(2,38).value = sDrive & " = " & sUNCPath
Next



If I do a query and echo, it will display drives in succession:

Dim oNet, oDrives, ix, sDrive, sUNCPath
Set oNet = CreateObject("Wscript.Network")
Set oDrives = oNet.EnumNetworkDrives
Wscript.Echo oDrives.Count / 2, "Network Connections"
For ix = 0 To oDrives.Count - 2 Step 2
    sDrive = oDrives(ix)
    sUNCPath = oDrives(ix+1)
    If sDrive = "" Then sDrive = "--"
    Wscript.Echo "Drive: " & sDrive, "UNC Path: " & sUNCPath
Next

I guess my question now is, how would I go about getting all drives into the excel doc in succession?
0
Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

 
LVL 43

Accepted Solution

by:
Steve Knight earned 250 total points
ID: 17849772
I guess you want:

'Wscript.Echo oDrives.Count / 2, "Network Connections"
row=35
For ix = 0 To oDrives.Count - 2 Step 2
    sDrive = oDrives(ix)
    sUNCPath = oDrives(ix+1)
    If sDrive = "" Then sDrive = "--"
    ws.Cells(2,row).value = sDrive & " = " & sUNCPath
    row=row+1
Next

But that is all drive mappings not just permanent mappings... hang on of course having said that if you run it at the start of your login script then I suppose it *would* only be permanent mappings, doh!  In which case surely even net use > something.txt would give you it too.

Steve
0
 

Author Comment

by:rtmcmullen
ID: 17857038
Steve, thanks, that works great, but your right, that list all drive mappings.  To back up a little, I also want this to execute outside of a login script so I can do a audit to determine what drives are mapped persistently even for users not using login scripts.  (non standard)  I would want to run against a list of computers using a for loop to find persistent mappings.  I don't want to blow away persistent drive mappings for users once I bring everyone under a login script, rogue users, etc.,

The only thing I can think of is to read the reg key you listed:
oShell.RegRead ("HKCU\Network\X\RemotePath")

How would I go about conditioning that to read the letter and value in a script though?

0
 

Author Comment

by:rtmcmullen
ID: 17859322
If anyone is interested, I create the code below.  Thanks for your help Steve.


'==============================================================================================
' NAME: PersitentDrive.vbs
'
' AUTHOR: rtmcmullen
' CREATED : 11/2/2006
' LAST MODIFIED: 11/2/2006
' VERSION: 1.0
'
' PURPOSE: To read both Registry subkey and value to determine "Persistent" Mapped drives ONLY.  
'               Outputs information
' SYNTAX:  cscript //nologo persistentdrive.vbs
' SYNTAX to append output to log file: cscript //nologo persistentdrive.vbs >> "\\Server\Share\%COMPUTERNAME%-PeristentMappings.log"
'       Example of output created in text file:
'            Date = 2-11-2006
'            Domain\Username = AMERICAS\rtmcmulle
'            MAC Address = 00:0B:DB:C6:F6:25
'            OS = Microsoft Windows XP Professional
'            Service Pack = Service Pack 2
'            Persistent Drive Mapping = X:\\AMERICAS-WILM-APP01\APPS
'            Persistent Drive Mapping = Z:\\AMERICAS-WILM-APP01\APPS
'
'==============================================================================================

'***********************************************************************************************************
'Explicitly Declare Variables
Dim WSHNetwork, oDrives, ix, sDrive, sUNCPath, count

'***********************************************************************************************************

'Get Date
WScript.Echo "Date = " & Day(Now) & "-" & Month(Now) & "-" & Year(Now)

'***********************************************************************************************************

'Set Objects
Const wbemFlagReturnImmediately = &h10
Const wbemFlagForwardOnly = &h20
Set WSHNetwork = CreateObject("Wscript.Network")
Set oDrives = WSHNetwork.EnumNetworkDrives

'***********************************************************************************************************

' WMI for local computer
strComputer = "."

'***********************************************************************************************************

' Get Computer System Details
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_ComputerSystem",,48)
For Each objItem In colItems
WScript.Echo "Domain\Username = " & objItem.UserName
Next

'***********************************************************************************************************

' Get MAC Address
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_NetworkAdapterConfiguration where IPEnabled=TRUE",,48)
For Each objItem In colItems
WScript.Echo "MAC Address = " & objItem.MACAddress(0)
Next

'***********************************************************************************************************

' Get OS Details
Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set colItems = objWMIService.ExecQuery("Select * from Win32_OperatingSystem",,48)
For Each objItem In colItems
WScript.Echo "OS = " & objItem.Caption
WScript.Echo "Service Pack = " & objItem.CSDVersion
Next

'***********************************************************************************************************

'Read SUBKEY (Registry KEY read using WMI query)
Const HKEY_CURRENT_USER = &H80000001
strComputer = "."

Set oReg=GetObject("winmgmts:{impersonationLevel=impersonate}!\\" & _
    strComputer & "\root\default:StdRegProv")
 
strKeyPath = "Network"
oReg.EnumKey HKEY_CURRENT_USER, strKeyPath, arrSubKeys
 
For Each subkey In arrSubKeys
'          Wscript.Echo subkey
'Next
'***********************************************************************************************************

'***********************************************************************************************************
'Registry Value Read (Registry Value using shell)
Set WshShell = CreateObject ("WScript.Shell")
Path = "HKCU\Network\Z\Remotepath"
Value = WSHShell.RegRead (Path)
Wscript.Echo "Persistent Drive Mapping = " & (subkey & ":") & (Value)
'***********************************************************************************************************
Next


0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 17859388
Thanks for giving me the points, nice script.

Steve
0

Featured Post

New My Cloud Pro Series - organize everything!

With space to keep virtually everything, the My Cloud Pro Series offers your team the network storage to edit, save and share production files from anywhere with an internet connection. Compatible with both Mac and PC, you're able to protect your content regardless of OS.

Join & Write a Comment

I'm a big fan of Windows' offline folder caching and have used it on my laptops for over a decade.  One thing I don't like about it, however, is how difficult Microsoft has made it for the cache to be moved out of the Windows folder.  Here's how to …
Resolve DNS query failed errors for Exchange
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now