Try the undocumented ntquerysysteminformation function.