71

Using Windows 7 Enterprise with SP1, but I'm hoping to get a generic answer that would apply to Windows XP/2003/2008/Vista/7.

From a command prompt, I execute a net use command to map the Z: drive to a share on another computer, but I don't use my current credentials, I specify a different domain and user to map the drive.

net use z: \\rd-pc2037\C_DRIVE password /user:rd-pc2037\Administrator

The command completes successfully. Now that the drive is mapped, how can I find what Domain and Username I used to successfully map the drive? I can't seem to find what I want with the net use command.

C:\Users\rdomarat>net use 
New connections will not be remembered.

Status       Local     Remote                    Network
---------------------------------------------------------------------------- 
OK           Z:        \\rd-pc2037\C_DRIVE       Microsoft Windows Network 
The command completed successfully.

C:\Users\rdomarat>net use Z: 
Local name        Z: 
Remote name       \\rd-pc2037\C_DRIVE 
Resource type     Disk 
Status            OK
# Opens           0
# Connections     1 
The command completed successfully.

Checking the properties of the share in Windows Explorer and looking at the security tab showed me what permissions different people would have, but I didn't see how which DOMAIN\User I had used. I searched through the registry with limited success as well.

Any thought?

Machavity
  • 30,841
  • 27
  • 92
  • 100
Reg Domaratzki
  • 895
  • 2
  • 7
  • 11

4 Answers4

83

WMI is your friend:

> wmic netuse where LocalName="Z:" get UserName /value

UserName=rd-pc2037\Administrator

[anonymous suggestion 2022-08-07]:

Since Microsoft is gradually moving away from WMI, Powershell/CIM is your future friend:

Get-CimInstance -classname Win32_NetworkConnection | select-object Remotename,Username

TerDale
  • 980
  • 9
  • 11
  • 9
    You can accomplish this in PowerShell with `gwmi -Query 'Select LocalName, RemoteName, UserName from Win32_NetworkConnection'` – Bacon Bits Mar 22 '13 at 17:40
  • 7
    A slightly better version: `gwmi -Query 'Select * from Win32_NetworkConnection' | Select-Object LocalName, RemoteName, UserName, ConnectionState | Sort-Object LocalName | ft -auto` – John Homer Feb 04 '15 at 14:50
  • 16
    to list all mappings in with just the path and username you can use `wmic netuse get remotename,username` – Drew Chapin Jan 08 '16 at 14:47
  • 5
    This command only shows the currently logged in user, not the one used for the remote connection – MHolzmayr Sep 24 '18 at 12:19
  • As #MHolzmayr said, this solution is incorrect. What worked for me is the solution provided by #John Suit – Dane411 Feb 03 '23 at 10:52
55

None of these answers help when using alternate credentials. They only show the current, local user. That doesn't help.

To view all stored credentials, use...

rundll32.exe keymgr.dll, KRShowKeyMgr
Glen Little
  • 6,951
  • 4
  • 46
  • 68
John Suit
  • 1,254
  • 12
  • 17
  • 2
    Great - in fact the only solution that worked for me! – Marwie Oct 12 '17 at 08:02
  • 3
    Thank you! And another way to find these alternative credentials is the "Credential Manager" in Control Panel. – mivk Nov 01 '18 at 12:48
  • This really works! The currently higher rated solution does only show the current logged in user. – kleenxcoder Jan 21 '19 at 07:55
  • Although this works as described (listing stored credentials), it does not show the particular account I used for connecting to a share, as the answer by @user3384575 does. I connected using `net use drive: \\unc /user:domain\user password /p:yes`, even if I run the command with elevated privileges. – R. Schreurs Feb 07 '22 at 12:01
10

According to http://technet.microsoft.com/en-us/library/cc957215.aspx the information you want is in the registry.

I have tried the wmic-command but it showed me the locally logged in user and not the "used DOMAIN\login"

The critical info from the link above:

Registry entry HKCU\Network\{Drive letter}\UserName is a REG_SZ that specifies the username (including domain name) whose credentials were used when the network drive was mapped.

phonetagger
  • 7,701
  • 3
  • 31
  • 55
user3384575
  • 101
  • 1
  • 2
  • 3
    Welcome to Stackoverflow! Thanks for your post. It helped me already (under Windows XP Home). But one short remark: It is always better to have all necessary information in the answer directly. And then, give a link to the original source. This way, your answer remains valuable even if the link goes down. – user1251007 Mar 16 '14 at 15:04
  • 1
    Doesn't seem to work on my Windows 7 machine. This value is now a REG_DWORD == 0. – ipetrik Jan 02 '19 at 01:25
0

Windows 11 -- some of this is useful, however Windows is still telling me that it has connected to a drive not listed in Windows Explorer, but which is not listed in computer, manage or net use or any of the options above. So Windows is storing connection information somewhere else.

There really should be a way to remove or replace persistent connections globally by username or servername.

Ali Kayn
  • 1
  • 1
    Your answer could be improved with additional supporting information. Please [edit] to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers [in the help center](/help/how-to-answer). – Community May 18 '22 at 03:39