Enumerate network drives from user profile

[Guest]

Hi

Is there any way to get information on a user's network drive mappings, from
their profile folder on the workstation? This is part of a security
investigation I am conducting into a huge number of failed logons from a
machine. If a network drive has been mapped with an out-of-date password,
this would explain the logon failure however there are multiple users of the
machine, and I need to know which users have drives mapped to administrative
network shares. Can anyone help me with this?

 

[Guest]

Depends very much on circumstances. For the current user a NET USE command
will list the shares. If you include

net use > \\server\writeableshare\%computername_%username%.txt

in a logon script this will give you a simple means to enumerate mappings
around the network. Likewise NET SHARE can be used to audit for unauthorised
shares.