Windows – Hiding network mapped drives in Windows XP

A little known one is

getmac

It shows the MAC address(es) of your network adapter(s).

The keys you're looking for are located here:

\\HKCU\Network

Each mapped drive is represented by a Registry key named for the drive letter. The properties of the mapping are contained in values - the ones you are most likely to be interested in are:

RemotePath REG_SZ
UserName   REG_SZ

The keys will only exist for Persistent connections, I don't think you can find transient mappings in the registry.

The biggest problem with this approach is that you have to either connect remotely to the users machine while they are logged in or connect and enumerate the user profiles, map those to SID's and then search in the relevant Key beneath HKEY_USERS to find the relevant copy of the users hive. That's going to be a bit of work and could be quite slow if you intend to do it a lot.

If this is a regular support issue then why not provide them with a link to a batch file that does something like:

Net use > \\someserver\someshare\%username%.drives

Then you just look in the share for the Username.drives file for a precise copy of what you need. Throw that into a logon script and you have a regularly refreshed copy but obviously you don't want to do that if you really don't need the info.

Edited to add If you want to pursue this using some Powershell scripting there's a sample script on this blog post by Hugo Peeters that shows how to connect to a remote registry but you will have to figure out how to map the username to their SID so you can choose the correct key under HKEY_USERS. Each user who has a profile on the target machine has a copy of their HKCU key saved under a key named with their SID, you need to find the right one and then pull the Network key information from under that.