Where is the network connection enabled/disabled setting stored?

Question

I have an Amazon EC2 instance of Windows Server 2008 where some genius managed to disable the network connection so that the instance is now isolated in its own little universe. I can shut down the instance and edit the "C:\" drive volume by attaching it to another running instance. This is equivalent to removing the system drive from a dead machine and attaching it to another computer to edit the files.

Question: Where is the network connection enabled / disabled setting stored?

If I can tweak this setting by editing the registry or a file to re-enable the network connection, I can then resurrect my Amazon server.

Solution

From the other PC, open the registry editor and load the HKLM hive from the 'offline' system (Registry -> Load Hive).

Under: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Add this command to run (changing the name of the connection if you need to):

netsh interface set interface "Local Area Connection" enabled

When you boot it, it should then enable the connection. I haven't tested that but it should work in theory.

Comments

[John Miner]

I went through that scenario last night. Programs running under "RunOnce" are invoked after the user logs on. Since I can't connect to the instance to log on this event never fires.

[sinping]

You're right, sorry. I was thinking that RunOnce ran at startup and Run was after login. In that case enable AutoAdminLogon under: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

[John Miner]

Well, thanks to your heads-up I can create a new instance, disable the network connection, re-boot the instance and then re-connect to the instance. However, for some reason I can't make the same changes on the off-line volume and then re-boot it and connect. Hmm!

[John Miner]

Just to follow up. Your suggestion of using the AutoAdminLogon key was the answer. Unfortunately, I wasn't familiar with the use of this key and had to read up (support.microsoft.com/kb/315231) to find out that this key has to be used in conjunction with DefaultUserName and DefaultPassword keys as well. Once this was done, my script executed when the default account logged in automatically and the connection was restored.

[John Miner]

To wrap up, my orginal question was naive. Enabling a network adapter by looking for a single key to trigger in the registry doesn't work. By doing a file compare on exported .reg files before and after a network connection is enabled, you can see that many changes in the registry were implemented. So this was not an appropriate approach for trying to tweak the registry in my off-line volume. Invoking a script to re-enable the adapter using the Run and AutoAdminLogon keys as described above is a better way to go.

[John Miner]

And finally, the NETSH command as shown above didn't work for me. I had to run a VB script using WMI to re-enable the adapter.

[John Miner]

Sorry, one more thing, given the keys associated with this question. There is a current problem with Windows 2008 EC2 system volumes. If you stop an EBS backed Windows 2008 instance, detach the system volume, attach it to another running Windows 2008 instance, tweak the volume, then detach the volume, attach it back to the original stopped instance and re-start the original instance, it screws up and you cannot RDP to it. Amazon support is currently trying to figure out why this doesn't work. Conclusion: The operation was a success but the patient died.