Windows registry artifactNetwork Shares
Displays the UNC path for a mounted network share
- Network Shares
- 7 keys
NTUSERUserSYSTEM
Registry keys
7 keys that RECmd reads for this artifact
NTUSERRemotePathrecursiveNetworkDisplays the UNC path for a mounted network share
UserRemotePathrecursiveNetworkDisplays the UNC path for a mounted network share - Windows Store UWP
NTUSERUserNamerecursiveNetworkDisplays the user account associated with the mounted network share
UserUserNamerecursiveNetworkDisplays the user account associated with the mounted network share - Windows Store UWP
NTUSERProviderNamerecursiveNetworkDisplays the provider of the mounted network share
UserProviderNamerecursiveNetworkDisplays the provider of the mounted network share - Windows Store UWP
SYSTEMrecursiveControlSet00*\Services\LanmanServer\SharesDisplays the share names and permissions of network shares
References
3 links
- social.technet.microsoft.com/Forums/ie/en-US/65eb8a2f-988f-40a7-b6ff-616a050c8efc/list-all-mapped-drives-for-all-users-that-have-logged-into-a-computer?forum=ITCG(opens in new tab)
- coretechnologies.com/blog/windows-services/lanmanserver/(opens in new tab)
- docs.microsoft.com/en-us/troubleshoot/windows-client/networking/saving-restoring-existing-windows-shares(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)