3

I have a System.Management.WqlEventQuery listening for the "__InstanceOperationEvent" event. This event is the base class for the "__InstanceCreationEvent", "__InstanceDeletionEvent", and "__InstanceModificationEvent" events, so it captures all three.

When my WqlEventQuery.Condition is "TargetInstance ISA 'Win32_LogicalDisk'", I get events for logical disks only, as expected.

However, when my WqlEventQuery.Condition is "(TargetInstance ISA 'Win32_LogicalDisk' or TargetInstance ISA 'Win32_MappedLogicalDisk')", I still get only Win32_LogicalDisk events. Alternatively, I should also be able to use WqlEventQuery.Condition set as "TargetInstance ISA 'CIM_LogicalDisk'", because CIM_LogicalDisk is the base class for both Win32_LogicalDisk and Win32_MappedLogicalDisk. Unfortunately, this alternative query also returns only Win32_LogicalDisk events.

In summary, I cannot seem to capture Win32_MappedLogicalDisk events. My assumption is that such an event should be generated when I right click a network share and map it as a network drive to a new drive letter. Despite this new mapped drive showing up in Explorer just fine, my program never receives any event.

Are any of my assumptions wrong? What is a Win32_MappedLogicalDrive or what distinguishes it from a Win32_LogicalDrive whose DriveType is "NetworkDrive"? How can I capture events for connecting/disconnecting network drives using WMI?

UPDATE: I posted more on this problem here: http://social.technet.microsoft.com/Forums/en-US/ocsmanagement/thread/1c92f08b-b9c9-4f27-a1bb-0c16a8868d19 It's turning out to be an unfortunate side-effect of UAC, with no work around except to create duplicate drive mappings under an administrative account.

Triynko
  • 18,766
  • 21
  • 107
  • 173

1 Answers1

3

I searched around figuring this was (as usual) some kind of Vista/Window 7 UAC-related behavior, and sure-enough... http://www.vistax64.com/powershell/270814-win32_mappedlogicaldisk-returns-null-vista.html

Since mapped drives are "per user", a drive mapped by a non-elevated user (e.g. from Explorer) cannot be seen by a WMI query running elevated as administrator. That's counter-intuitive, because usually an application can access more information running as an administrator, not less. So depending on who mapped the drive, it may be visible to a program depending on whether it's running with elevated privileges or not. I guess I will have to use the impersonation options to ensure the program locates all the drives it can possibly access.

In addition, once this was working, I saw duplicate entries for networked drives and realized that the set of Win32_LogicalDisk objects includes Win32_MappedLogicalDisk objects, even though Win32_MappedLogicalDIsk is not a Win32_LogicalDisk as far as any class hierarchy is concerned. Win32_MappedLogicalDisk, like Win32_LogicalDisk, extends directly from CIM_LogicalDisk according to the documentation.

See discussion on problems caused by UAC for mapped drives here: http://blogs.msdn.com/b/cjacks/archive/2007/02/19/mapped-network-drives-with-uac-on-windows-vista.aspx?PageIndex=2

Excerpt:

"My stub is running elevated to admin. Are you suggesting that somehow it can detect what drives the standard user had mapped, and then do the mapping again? Or do I need two stubs: the first runs without elevation, a makes a list (say, to the registry) of the mapped drives, then shells out to stub #2, which asks for elevation to admin, reads the registry list and re-maps the drives. Sounds kinda Rube Goldberg-like to me!"

Another workaround is kind of like duplicating the drive mappings for administrators, but involves allowing normal user drive mappings to be shared with administrators by linking thier tokens. See http://support.microsoft.com/kb/937624

Triynko
  • 18,766
  • 21
  • 107
  • 173