Michael_Gray
asked on
Where is drive mapping info stored?
Hello all,
Can someone tell me where drive mapping info is stored? If I map a Z: drive to \\server\share, where is that info stored locally?
Thanks!!
Can someone tell me where drive mapping info is stored? If I map a Z: drive to \\server\share, where is that info stored locally?
Thanks!!
If you go to the command line, and type net use, you'll see all of the mappings in use, as well as some of the shares. That way, if you want to remove mappings, you can do net use Z: /delete
Hi,
The map drive information stored in the registry entry file. when the we run any command like masnrock tell you in his comment then its search the drive information in registry key like if we use the netuse command then netmsg.dll run and its serach the registry entries for map drive if found then its show.
registry entry in c:\windows\system32\regedi t
start > run > regedit pres enter you got file and i think you are already check it mant time.
The map drive information stored in the registry entry file. when the we run any command like masnrock tell you in his comment then its search the drive information in registry key like if we use the netuse command then netmsg.dll run and its serach the registry entries for map drive if found then its show.
registry entry in c:\windows\system32\regedi
start > run > regedit pres enter you got file and i think you are already check it mant time.
Hi,
The map drive information stored in the registry entry file. when the we run any command like masnrock tell you in his comment then its search the drive information in registry key like if we use the netuse command then netmsg.dll run and its serach the registry entries for map drive if found then its show.
registry entry in c:\windows\system32\regedi t
start > run > regedit pres enter you got file and i think you are already check it mant time.
In registry there is HKEY_LOCAL_MACHINE > hardware option which all the information like
Hardware: Database that describes the physical hardware in the computer, the way device drivers use that hardware, and mappings and related data that link kernel-mode drivers with various user-mode code. All data in this sub-tree is re-created everytime the system is started.
There are three subkeys under HARDWARE, these are the Description key, the DeviceMap key, and the ResourceMap key. The Description key has describes each hardware resource, the DeviceMap key has data in it specific to individual groups of drivers, and the ResourceMap key tells which driver goes with which resource.
Please check the following knowledge base article for registry in which the mapping drive entries
http://www.governmentsecurity.org/articles/WindowsNTRegistryTutorial.php
The map drive information stored in the registry entry file. when the we run any command like masnrock tell you in his comment then its search the drive information in registry key like if we use the netuse command then netmsg.dll run and its serach the registry entries for map drive if found then its show.
registry entry in c:\windows\system32\regedi
start > run > regedit pres enter you got file and i think you are already check it mant time.
In registry there is HKEY_LOCAL_MACHINE > hardware option which all the information like
Hardware: Database that describes the physical hardware in the computer, the way device drivers use that hardware, and mappings and related data that link kernel-mode drivers with various user-mode code. All data in this sub-tree is re-created everytime the system is started.
There are three subkeys under HARDWARE, these are the Description key, the DeviceMap key, and the ResourceMap key. The Description key has describes each hardware resource, the DeviceMap key has data in it specific to individual groups of drivers, and the ResourceMap key tells which driver goes with which resource.
Please check the following knowledge base article for registry in which the mapping drive entries
http://www.governmentsecurity.org/articles/WindowsNTRegistryTutorial.php
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Thanks! I'll give this a look this afternoon when I have access to the workstation.
You should be able to remotley access the registry on the workstation.
If you open up Regedit and then go to 'File' menu and then 'Connect Network Registry' and you should be able to enter in the remote host and connect to the registry for that workstation, bear in mind that in this view you will not have the standard RegKey layout of
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Instead you will only see
HKEY_LOCAL_MACHINE
HKEY_USERS
When you expand the HKEY_USERS key you wil see a list of SID's for logged on users, you can either use a utility called GetSid to enumerate the user's SID or right click on the SID and select Permissions, this will tell you which SID matches up to your user. If your user is not logged on, then you will not see a SID listed there. What you can do in this instance is to use regedt32 instead of regedit. As this allows you to import a users NTUSER.DAT into the HKEY_USERS hive. I can supply more info on that if you want.
If you open up Regedit and then go to 'File' menu and then 'Connect Network Registry' and you should be able to enter in the remote host and connect to the registry for that workstation, bear in mind that in this view you will not have the standard RegKey layout of
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_CURRENT_CONFIG
Instead you will only see
HKEY_LOCAL_MACHINE
HKEY_USERS
When you expand the HKEY_USERS key you wil see a list of SID's for logged on users, you can either use a utility called GetSid to enumerate the user's SID or right click on the SID and select Permissions, this will tell you which SID matches up to your user. If your user is not logged on, then you will not see a SID listed there. What you can do in this instance is to use regedt32 instead of regedit. As this allows you to import a users NTUSER.DAT into the HKEY_USERS hive. I can supply more info on that if you want.
having a similar problem.
I verified that the HKEY_CURRENT_USER\Network\ contains drive letters but
what about the unamed connections which do not get a "Local" name attached to it
(thinking of net use here) ?
thanks, Markus
I verified that the HKEY_CURRENT_USER\Network\
what about the unamed connections which do not get a "Local" name attached to it
(thinking of net use here) ?
thanks, Markus