Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ?

According to : Forensic Focus, it should be under


but its not here. Help is appreciated. Thanks

share|improve this question

There's some stuff under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 that looks promising.

Sorry, my Win7 machine hasn't been on very many network shares in it's lifetime but I think they are all there, thought some are just GUIDs.

share|improve this answer

Try looking under HKEY_CURRENT_USER\Network that will show you the current mapped network drives for the current user based on the drive letter. Or HKEY_Users\<sid>\Network for a particular user (based on the SID).

While my answer will show what drives a user has mapped to a drive letter, adric's will show you the drives accessed that were not mapped to a drive letter (via UNC, etc).

Same path concept applies:

Current User:


Specific User (by SID):

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.