Win32_LogicalDisk Not Working Properly

[Guest]

I've created a vbscript to query the drives of remote computers (all are
Windows XP) using WMI's Win32_LogicalDisk. If I run this query on my local
computer I see all of the drives listed and the ProviderName showing the
Network drives' paths. If I run this same script to check remote computers I
get either 1 or no mapped network drives showing (even though I know they
have a few mapped drives) and the ProviderName is empty for the mapped drive
that is shown. I run the vbscript logged on as a domain admin, so I figure I
should have the rights to query this information. Is there something else I
need to consider? Thanks for any help.

 

[Jim Vierra]

Read the individual field infos carefully. They are not all they may seem
to be.

ProviderName is the "Network Path" of a share. Visibility of the share is
dependent on the account the share is mapped with and not on the system
itself.

You would need to query the account associations to find remote shares. It
appears that when you run it locally you are logged in and the mapped drives
are connected so they show up. Remote queries are not "interactive" so the
mappings are not available. The WMI query only shows what is available to
the account running the query.

Hope this is clear.
Here is the docs link.
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/wmisdk/wmi/win32_logicaldisk.asp

 

[Guest]

Thank you for the response. If I'm understanding you correctly, I have taken
this into account. When I'm querying these computers I know the user is
logged in. For instance, a user is logged into his computer and has 4 drives
mapped (J:, H:, R:, S. My script shows only one drive mapped (R and shows
the ProviderName variable for this share as an empty string. Another test I
tried was to query my main computer that I'm logged into with my regular
account from my test computer (logged in with my domain admin account). I
have 3 mapped network drives and the script is showing no mapped drives. I've
tried querying about 5 different computer with users logged in with varying
results. I would think that I would either see all of the drives or none of
the drives.

Or are you suggesting that I can't see the J:, H:, & S: drives from the
script, because my account would be restricted from those paticular shares? I
do have the same share mapped to my J: drive as the remote computer does. Is
there something else that I'm missing?

 

[Jim Vierra]

Doesn't matter if the user is logged in. The mappings are only shown for
the session you are remotely impersonating which is not interactive and
doesn't have any mapped drives. You need to enum sessions and find the
associators of the users session to see there mapped drives. You can't do
it any other way that I can think of. A raw computer does not have any
mapped drives. Only user sessions have drive mappings and only when running
interactively.

You will see drives that are physically on the computer and perhaps a drive
that has become involved in a system process like a virus scan or
replication.

On W98 you may see the mapped drives as there is no real differentiation
between a user session and a system session.

 

[Guest]

OK, now I see what you are saying. I didn't realize that I was creating an
actual session by doing a WMI query. Just before I do the WMI query with
Win32_LogicalDisk, I do this:

Set colItems = objWMIService.ExecQuery("Select * from
Win32_ComputerSystem",,48)
For Each objItem In colItems
txtResults.Value = txtResults.Value & "Computer: " & objItem.Name & vbCrLf
txtResults.Value = txtResults.Value & "UserName: " & objItem.UserName &
vbCrLf
Next

Which only showed one user - the one that is physically logged in to the
computer, so I was thrown off by that. How would I go about enumerating the
session? I can't seem to find any information regarding that with WMI.

 

[Jim Vierra]

You are NOT creating an "actual" session. You are creating a remote WMI
session that can "impersonate" you.

There is a session class in WMI. Look it up. Enumerate the user session
you want to view and it's associators. You have to follow that chains and
detect the class of the object. It's not straight forward. You can also
retrieve mappings from any loaded profile hive.

--
Jim Vierra

OK, now I see what you are saying. I didn't realize that I was creating an
actual session by doing a WMI query. Just before I do the WMI query with
Win32_LogicalDisk, I do this:

Set colItems = objWMIService.ExecQuery("Select * from
Win32_ComputerSystem",,48)
For Each objItem In colItems
txtResults.Value = txtResults.Value & "Computer: " & objItem.Name &
vbCrLf
txtResults.Value = txtResults.Value & "UserName: " & objItem.UserName &
vbCrLf
Next

Which only showed one user - the one that is physically logged in to the
computer, so I was thrown off by that. How would I go about enumerating
the
session? I can't seem to find any information regarding that with WMI.