Determine the account used to map a network drive

Today someone approached me about a windows network drive that could not be reconnected because the user account that was used to map the network drive was locked out.  The problem was that nobody could remember which account was used, and with the number of people in our organization there could be quite a few accounts locked out at any one time. 

Rather than sort through a list of locked out users and hope that one rang a bell, I thought it would be easier to just see which account was used to map the drive by checking the registry.  As an example, assume that I have mapped drive Z: to the following path…

\\fileserver.sweeneyops.lab\fileshare

And that I used the following credentials to map it…

sweeneyops\myaccount

Now lets assume that I forgot which account I used.  I simply open REGEDIT and perform a search for the UNC path.  After a moment the search will take me to a registry key called “Z” beneath the SID key for the logged in user.  Basically that looks something like this:

HKEY_USERS > USER_SID > Network > Z

Beneath the Z key you’re going to find several STRING (REG_SZ) and DWORD (REG_DWORD) values.  You want to look for the UserName STRING value, which indicates the name of the account that is used to map the drive.

Advertisements
  1. No trackbacks yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: