Get UNC path from mapped drive-letter after impersonation

Question

If I call function WNetGetUniversalName() to get UNC path from drive mapped in current session, the function succeeds.

But...

• If I create a new logon sesssion by calling LogonUser() (The logon user is same as the process creator)
• Impersonate with the logged on user by calling ImpersonateLoggedOnUser() function
• And again call WNetGetUniversalName(), the function returns error 2250 (ERROR_NOT_CONNECTED)

The thing is I should should be running this process as a service (in SYSTEM account) so I may require to impersonate the user to get the mapped-drives of that user and associated network paths. As I checked, the information cannot be accessed across user-sessions.

Where does Windows store this information, so that are it can remap the drives when user logs-in back? I found that mapped network-paths history is kept in registry under key: HKEY_USERS\<User SID>\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU but it does not say if the UNC path will be mapped when user will login back and the associated drive-letter.

Please help.

Answer 1

If I recall correctly I believe these drive mappings are stored in the logon session. Since LogonUser() creates a new logon session it will not have the drive mappings; you would have to use ImpersonateLoggedOnUser() with an existing token.