I haven't tried reading from the registry yet because I kinda dismissed the idea as we don't have administrative priviledges on the remote machines (they are clients running in their own network, but connecting to our network via VPN to run applications on a Terminal Server).

About RPC using dynamic ports (like MAPI and Oracle Net communication) I did think if it was the case, but kinda hoped it would be possible anyway.

On another note, I know that a network scanner like NSS from GFI (www.gfi.com) detects the OS even when scanning a host you havenm't admin privs on - I don't know how they do it (I wrote their tech support yesterday in hope that they could help) - maybe they use different ways to check for the name of the OS (SNMP, banner from the FTP service, reads the registry, RPC calls etc.), whatever is possible on the system in question...

Anyway, it seems to be a very cumbersome task to retrieve the info, but I'll keep looking and trying and post whatever I discover. Thanks for you help so far - and if you think of anything more, please don't hesitate to write [Smile]

Thanks!

/Nicolaj