Mo,

If you have one of this:

Client: Included in Windows XP, Windows 2000 Professional, Windows NT Workstation 4.0 SP4 and later.
Server: Included in Windows Server 2003, Windows 2000 Server, Windows NT Server 4.0 SP4 and later.

And if you have rights (or can give the username and password of someone with rights) to run WMI on the remote computer, you can use WMI:

lparameters tcComputer, tcUser, tcPassword
local lcComputer, loWMIService, loWBEMLocator, loNetWork, lcDomain
local loLocator, lcUser, lcPassword, lcDomain, loNetWork, lnDevice
local loOSs, loOS, lcWindosDirectory


lcDomain		= getenv('USERDOMAIN')  && For windows XP, I do not know if this is valid for all OS
lcUser			= Iif(Vartype(tcUser) = 'C', tcUser, '')
lcPassword		= Iif(Vartype(tcPassword) = 'C', tcPassword, '')
lcComputer		= Iif(Vartype(tcComputer) = 'C', tcComputer, '')
lnDevice		= Iif(Vartype(tnDevice) = 'N', tnDevice, 0)
lcWindowsDirectory	= 'Unknown'

try
	loWBEMLocator	= createObject("wbemScripting.SwbemLocator")
	if Empty(lcUser)
		loWMIService	= loWBEMLocator.ConnectServer(lcComputer, '\root\cimv2')
	else
		loWMIService	= loWBEMLocator.ConnectServer(lcComputer, '\root\cimv2', lcDomain + "\" + lcUser, lcPassword)
	endif
catch
	loWMIService		= null
endtry

if not Isnull(loWMIService)
	loOSs			= loWMIService.ExecQuery('Select WindowsDirectory from Win32_OperatingSystem')
	for each loOS in loOSs
		lcWindowsDirectory	= loOS.WindowsDirectory
		exit
	endfor
endif
return lcWindowsDirectory

If you want the System Directory (ie c:\windows\system32) then you can replace WindowsDirectory with SystemDirectory everywhere