Where does windows store network drive mappings?

90,798

Where does windows store network drive mappings?

When we map a network drive persistently in windows 7 an entry relating to the drive is created under the following key in registry:

HKEY_CURRENT_USER\Network

For each drive a key with the name as that of the drive letter is created. For example if you mapped a network drive with letter W the key will be HKEY_CURRENT_USER\Network\W

The key will contain the following values:

enter image description here

Source Mapped network drives in Windows 7 Registry


How do I load the registry from a different Windows Installation?

See this question Edit another Windows install's registry for instructions on how to load the registry for a different windows installation, for example when you have a non-bootable drive.


What about the credentials (Domain, username, Password)? Where do I find them?

Network Password Recovery from NirSoft can be used to recover network credentials, even from another external drive (eg from a dead system that cannot boot anymore).

This utility recovers all network passwords stored on your system for the current logged-on user. It can also recover the passwords stored in Credentials file of external drive, as long as you know the last log-on password.

enter image description here

...

Where the network passwords are stored?

Older versions of Windows (Windows 95,98 and ME) stored the network passwords in pwl files located under the main Windows folder.

Starting from Windows XP, the network passwords are encrypted inside the Credentials file, located under:

"Documents and Settings\<User Name>\Application Data\Microsoft\Credentials\<User SID>".

Some passwords may also be stored in the Credentials file under:

"Documents and Settings\<User Name>\Local Settings\Application Data\Microsoft\Credentials\<User SID>".

In addition to the passwords of network shares, Windows XP also stores the passwords of .NET Passport (MSN Messenger) in the same Credentials files

Credentials file in external drive

Starting from version 1.20, you can also read the Credentials from an external profile in your current operating system or from another external drive (For example: from a dead system that cannot boot anymore).

In order to use this feature, you must know the last logged-on password used for this profile, because the Credentials file is encrypted with the SHA hash of the log-on password, and without that hash, the Credentials file cannot be decrypted.

You can use this feature from the UI, by selecting the 'Advanced Options' in the File menu, or from command-line, by using /external parameter.

The user profile path should be something like "C:\Documents and Settings\admin" in Windows XP/2003 or "C:\users\myuser" in Windows Vista/2008.

Source Network Password Recovery v1.34 - Recover Windows XP/Vista network passwords (Credentials file)


Disclaimer

I am not affiliated with NirSoft in any way, I am just an end user of the software.

Share:
90,798

Related videos on Youtube

Mahmoud Khateeb
Author by

Mahmoud Khateeb

Updated on September 18, 2022

Comments

  • Mahmoud Khateeb
    Mahmoud Khateeb over 1 year

    I am not able to boot my windows 7, but I have access to the drive on which Windows 7 is installed.

    Is there anyway I can restore my network drives?

  • Mahmoud Khateeb
    Mahmoud Khateeb about 9 years
    What's about the credentials(Domain, username, Password)? where to find them?
  • DavidPostill
    DavidPostill about 9 years
    @MahmoudKhateeb See updated answer