I am trying to read the HKEY_USERS hive of a remote machine with this Class

Code:
    
Imports System.Management
Imports System.Management.Instrumentation


Public Enum RegHive As UInteger
    HKEY_CLASSES_ROOT = &H80000000UI
    HKEY_CURRENT_USER = &H80000001UI
    HKEY_LOCAL_MACHINE = &H80000002UI
    HKEY_USERS = &H80000003UI
    HKEY_CURRENT_CONFIG = &H80000005UI
End Enum

Public Enum RegType
    REG_SZ = 1
    REG_EXPAND_SZ = 2
    REG_BINARY = 3
    REG_DWORD = 4
    REG_MULTI_SZ = 7
End Enum
Public Class RemoteRegistry
    Implements IDisposable
    Friend Shared mc As ManagementClass

    Public Sub New(target As String)
        Dim options As New ConnectionOptions()
        options.Impersonation = ImpersonationLevel.Impersonate
        options.EnablePrivileges = True
        If My.Settings.WMIUsingAlternateCredentials Then
            options.Username = My.Settings.WMIUserID
            options.Password = My.Settings.WMIPassword
        End If

        Dim myScope As New ManagementScope("\\" & target & "\root\default", options)
        Dim mypath As New ManagementPath("StdRegProv")
        mc = New ManagementClass(myScope, mypath, Nothing)
    End Sub

Public Function EnumKeys(hDefKey As RegHive, sSubKeyName As String) As String()

        Dim retval As String()
        Dim inParams As ManagementBaseObject = mc.GetMethodParameters("EnumKey")
        Dim outParams As ManagementBaseObject

        inParams("hDefKey") = hDefKey
        inParams("sSubKeyName") = sSubKeyName
        outParams = mc.InvokeMethod("EnumKey", inParams, Nothing)
        retval = DirectCast(outParams.Properties("sNames").Value, String())
        
        Return retval
    End Function
End Class
The value of sSubKeyName is the user's SID + "\" + Network (e.g. S-1-5-21-1606980848-2025429265-839522115-560021\Network). Now under that key are various subkeys containing mapped drive letters. But it never returns anything.

Strangely, if I use the OpenRemoteBaseKey method it works BUT I don't want to use that because using WMI lets me specify alternate credentials and OpenRemoteBaseKey doesn't

Any ideas?