Find Source of Windows Mapped Drives

[scottalanmiller]

Many ways to skin a cat, but this seems to be an easy one. Need to find a list of mapped drives on a Windows machine, including the share that they are mapped from:

Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=4" | ForEach-Object { Write-Host ("{0} {1}" -f ($_.DeviceID), ($_.ProviderName)) }

[manxam]

@scottalanmiller - Note, this has be run under the user context and not administrator powershell. I couldn't figure out why none of my mapped drives were showing but then realized that I opened powershell as Administrator.

Duh...

[black3dynamite]

Seems to only work if the mapped drives are connected. Any way to show drives that are mapped but disconnected?

[scottalanmiller]

@manxam said in Find Source of Windows Mapped Drives:

@scottalanmiller - Note, this has be run under the user context and not administrator powershell. I couldn't figure out why none of my mapped drives were showing but then realized that I opened powershell as Administrator.

Duh...

Yeah, only mapped when the user is there. If the user isn't there, the drives aren't mapped.

[scottalanmiller]

@black3dynamite said in Find Source of Windows Mapped Drives:

Seems to only work if the mapped drives are connected. Any way to show drives that are mapped but disconnected?

No idea where that is stored.

[gjacobse]

Any idea if this will work via ScreenConnect CMD?

[scottalanmiller]

@gjacobse said in Find Source of Windows Mapped Drives:

Any idea if this will work via ScreenConnect CMD?

Does not.

[JaredBusch]

@scottalanmiller said in Find Source of Windows Mapped Drives:

@gjacobse said in Find Source of Windows Mapped Drives:

Any idea if this will work via ScreenConnect CMD?

Does not.

does, but you won't see user data as the SC session is run under an admin account.

[scottalanmiller]

@jaredbusch said in Find Source of Windows Mapped Drives:

@scottalanmiller said in Find Source of Windows Mapped Drives:

@gjacobse said in Find Source of Windows Mapped Drives:

Any idea if this will work via ScreenConnect CMD?

Does not.

does, but you won't see user data as the SC session is run under an admin account.

It didn't run for me at all, threw an error. Did you wrap it in something?

[JaredBusch]

@scottalanmiller said in Find Source of Windows Mapped Drives:

@jaredbusch said in Find Source of Windows Mapped Drives:

@scottalanmiller said in Find Source of Windows Mapped Drives:

@gjacobse said in Find Source of Windows Mapped Drives:

Any idea if this will work via ScreenConnect CMD?

Does not.

does, but you won't see user data as the SC session is run under an admin account.

It didn't run for me at all, threw an error. Did you wrap it in something?

[JaredBusch]

@scottalanmiller Again, this does you likely no good, as the admin session likely has nothing mapped in the first place. but it does run as it should.

[scottalanmiller]

@jaredbusch said in Find Source of Windows Mapped Drives:

@scottalanmiller Again, this does you likely no good, as the admin session likely has nothing mapped in the first place. but it does run as it should.

I don't see where you ran this..

Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=4" | ForEach-Object { Write-Host ("{0} {1}" -f ($_.DeviceID), ($_.ProviderName)) }

[JaredBusch]

@scottalanmiller said in Find Source of Windows Mapped Drives:

@jaredbusch said in Find Source of Windows Mapped Drives:

@scottalanmiller Again, this does you likely no good, as the admin session likely has nothing mapped in the first place. but it does run as it should.

I don't see where you ran this..

Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=4" | ForEach-Object { Write-Host ("{0} {1}" -f ($_.DeviceID), ($_.ProviderName)) }

bottom of the second screen shot..

I copied it right from this thread and ran it.

First without the foreach and then the full command.

[JaredBusch]

sequence:

• net use to show nothing mapped.
• net use s: \\fsldc02\software to map an S drive
• net use to show mapping.
• Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=4" with the approriate #!ps prefix for ScreenConnect
• Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=4" | ForEach-Object { Write-Host ("{0} {1}" -f ($_.DeviceID), ($_.ProviderName)) } with the approriate #!ps prefix.

[manxam]

@jaredbusch said in Find Source of Windows Mapped Drives:

@scottalanmiller Again, this does you likely no good, as the admin session likely has nothing mapped in the first place. but it does run as it should.

@JaredBusch and @scottalanmiller and this is where my original comment came in about admin account. Most RMM tools run under elevated privileges and, therefore, return no data as they're not running under the user context. One could, however, likely do a "Start-Process powershell.exe -Credential "domain\user"" before the wmic command but it gets awfully complicated at that point.

[JaredBusch]

@manxam said in Find Source of Windows Mapped Drives:

@jaredbusch said in Find Source of Windows Mapped Drives:

@scottalanmiller Again, this does you likely no good, as the admin session likely has nothing mapped in the first place. but it does run as it should.

@JaredBusch and @scottalanmiller and this is where my original comment came in about admin account. Most RMM tools run under elevated privileges and, therefore, return no data as they're not running under the user context. One could, however, likely do a "Start-Process powershell.exe -Credential "domain\user"" before the wmic command but it gets awfully complicated at that point.

Yes, you are right, but I was just correcting the statement that it would not run from ScreenConnect.

[manxam]

@jaredbusch, totally understood. I wasn't claiming otherwise. I just wanted to vocalize it for others who jump into the thread.
Thanks for the verification.

[scottalanmiller]

@jaredbusch said in Find Source of Windows Mapped Drives:

• Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=4" | ForEach-Object { Write-Host ("{0} {1}" -f ($_.DeviceID), ($_.ProviderName)) } with the approriate #!ps prefix.

I've not used that before. I use @powershell and that normally works but did not work here.

[JaredBusch]

@scottalanmiller said in Find Source of Windows Mapped Drives:

@jaredbusch said in Find Source of Windows Mapped Drives:

• Get-WmiObject -Class Win32_LogicalDisk -Filter "DriveType=4" | ForEach-Object { Write-Host ("{0} {1}" -f ($_.DeviceID), ($_.ProviderName)) } with the approriate #!ps prefix.

I've not used that before. I use @powershell and that normally works but did not work here.

That is the proper way to run powershell from ScreenConnect.

So what you were doing was launch powershell from a command prompt session.

Doing @powershell, you probably need to handle escaping quotes or something is all.

[scottalanmiller]

@jaredbusch said in Find Source of Windows Mapped Drives:

Doing @powershell, you probably need to handle escaping quotes or something is all.

Likely