He guys, I was trying to write a script to enumerate the disk sig on a drive that gets mounted by looking in HKLM\SYSTEM\MountedDevices but it seems that gets populated and stays populated.
Anyone know how to enumerate the sig on only what _is_ mounted, so when a disk is unmounted that sig wont be present? Thanks! jlc ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
