Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ?

According to : Forensic Focus, it should be under

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion

but its not here. Help is appreciated. Thanks

share|improve this question
add comment

2 Answers

Try looking under HKEY_CURRENT_USER\Network that will show you the current mapped network drives for the current user based on the drive letter. Or HKEY_Users\<sid>\Network for a particular user (based on the SID).

While my answer will show what drives a user has mapped to a drive letter, adric's will show you the drives accessed that were not mapped to a drive letter (via UNC, etc).

Same path concept applies:

Current User:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPounts2 

Specific User (by SID):

HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPounts2 
share|improve this answer
add comment

There's some stuff under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 that looks promising.

Sorry, my Win7 machine hasn't been on very many network shares in it's lifetime but I think they are all there, thought some are just GUIDs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.