Link to home
Start Free TrialLog in
Avatar of Michael_Gray
Michael_Gray

asked on

Where is drive mapping info stored?

Hello all,

Can someone tell me where drive mapping info is stored?  If I map a Z: drive to \\server\share, where is that info stored locally?

Thanks!!
Avatar of masnrock
masnrock
Flag of United States of America image

If you go to the command line, and type net use, you'll see all of the mappings in use, as well as some of the shares. That way, if you want to remove mappings, you can do net use Z: /delete
Hi,

The map drive information stored in the registry entry file. when the we run any command like masnrock tell you  in his comment then its search the drive information in registry key like if we use the netuse command then netmsg.dll run and its serach the registry entries for map drive if found then its show.

registry entry in c:\windows\system32\regedit

start > run > regedit pres enter you got file and i think you are already check it mant time.
Hi,

The map drive information stored in the registry entry file. when the we run any command like masnrock tell you  in his comment then its search the drive information in registry key like if we use the netuse command then netmsg.dll run and its serach the registry entries for map drive if found then its show.

registry entry in c:\windows\system32\regedit

start > run > regedit pres enter you got file and i think you are already check it mant time.

In registry there is HKEY_LOCAL_MACHINE > hardware option which all the information like

Hardware:  Database that describes the physical hardware in the computer, the way device drivers use that hardware, and mappings and related data that link kernel-mode drivers with various user-mode code. All data in this sub-tree is re-created everytime the system is started.

There are three subkeys under HARDWARE, these are the Description key, the DeviceMap key, and the ResourceMap key. The Description key has describes each hardware resource, the DeviceMap key has data in it specific to individual groups of drivers, and the ResourceMap key tells which driver goes with which resource.

Please check the following knowledge base article for registry in which the mapping drive entries

http://www.governmentsecurity.org/articles/WindowsNTRegistryTutorial.php

ASKER CERTIFIED SOLUTION
Avatar of davidsummers
davidsummers

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Michael_Gray
Michael_Gray

ASKER

Thanks!  I'll give this a look this afternoon when I have access to the workstation.
You should be able to remotley access the registry on the workstation.

If you open up Regedit and then go to 'File' menu and then 'Connect Network Registry' and you should be able to enter in the remote host and connect to the registry for that workstation, bear in mind that in this view you will not have the standard RegKey layout of
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG

Instead you will only see
HKEY_LOCAL_MACHINE
HKEY_USERS

When you expand the HKEY_USERS key you wil see a list of SID's for logged on users, you can either use a utility called GetSid to enumerate the user's SID or right click on the SID and select Permissions, this will tell you which SID matches up to your user. If your user is not logged on, then you will not see a SID listed there. What you can do in this instance is to use regedt32 instead of regedit. As this allows you to import a users NTUSER.DAT into the HKEY_USERS hive. I can supply more info on that if you want.
having a similar problem.
I verified that the HKEY_CURRENT_USER\Network\ contains drive letters but
what about the unamed connections which do not get a "Local" name attached to it
(thinking of net use here) ?

thanks, Markus