We want to "flag" end-user systems that have mapped a particular network drive.

The Registry key HKEY_CURRENT_USER\Network\X (where X can be any drive letter) has the value that we want. So, we draft up a custom rule that looks something like:


RegistryValueEquals(HKEY_CURRENT_USER\Network\X, RemotePath, MappedPathHere) OR


This is literally duplicated for every value of X for E to Z. Needless to say, it's pretty ugly to look at for twenty-two occurrences and is kind of hack. It'd be nice to bring this down to just a few lines, ideally one. Does the KBOX have any support for wildcards or RegEx in this capacity? Something that would make this query less of an eyeball sore to look at?
0 Comments   [ + ] Show Comments

Comments

Please log in to comment

Rating comments in this legacy AppDeploy message board thread won't reorder them,
so that the conversation will remain readable.

Answers

0
Keep in mind that CURRENT_USER will only be relevant when someone is logged in. But that's probably okay since the mapping likely only exists when the user is logged in.

If you are just looking for the occurrence of a mapping maybe you could do a "net use" output and parse it into a CI rule for shell command

E.g.
net use | find /I "RemotePath"

or a vbs script that does the same kind of thing: http://www.kace.com/support/kb/index.php?action=artikel&cat=5&id=968&artlang=en

You could capture the entire listing and then have a smart label or report or email alert based on the contents.
Answered 10/11/2011 by: GillySpy
Seventh Degree Black Belt

Please log in to comment
Answer this question or Comment on this question for clarity