Map Network Drive MRU

Shares this user typed into the Map Network Drive window, newest first.

Use it to find the file shares a user mapped as drives, which shows where on the network they went looking.

NTUSER.DAT
File and Folder Access

What It Is

When a user maps a drive through the Map Network Drive window in Explorer, Windows records the share path here, newest first. Each entry shows where on the network a user went looking, because they named a share to map a drive to it. Drives mapped another way are not recorded. It lives in the user's own NTUSER.DAT.

What It Proves

The user mapped, or tried to map, a drive to that share through Explorer. The newest entry was used at the key last write time.

What It Does Not Prove

Drives mapped with net use, by logon scripts or by policy are not recorded here. Only the newest entry has a time.

Where It Lives

Map Network Drive MRU lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU

C:\Users\<user>\NTUSER.DAT

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Map Network Drive MRU, each with what it tells you
Registry Value	What It Tells You
`b` `REG_SZ\\srv-fin-01\Finance`	alice mapped the Finance share on srv-fin-01 at the key time, 14 Oct 2026 22:23 UTC. If srv-fin-01 audits file shares, event 5140 in its Security log confirms it.
`a` `REG_SZ\\srv-files\projects`	Earlier she mapped \\srv-files\projects, with no time of its own. Ask whether her job needs it before you treat it as part of the incident.
`Network\Z\RemotePath` `REG_SZ\\srv-fin-01\Finance`	Drive Z is still mapped to the Finance share and reconnects at each of alice's logons. Check srv-fin-01's event 4624 in the Security log for her network sign-ins after 14 Oct.

How to Read It

Values a, b, c and so on hold the UNC share paths, and MRUList gives the order, newest first. The key's last write time belongs to the first letter in MRUList. Drives set to reconnect at sign-in sit under Network\<drive letter> in the same hive, with RemotePath and UserName.

When Windows Writes It: When the user maps a drive through the Map Network Drive window.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Registry Explorer, RECmd, RegRipper (mndmru)

Hunt It

What a user mapped through this window is kept only in this per-user key, so parse the hive, or read it live with Velociraptor. The server's Security log shows the share actually being reached, when the server audits file shares.

Sees Related ActivityDeviceNetworkEvents

Windows opens SMB from the System process, so this names servers, not users or shares. The MRU says which share the user mapped.

KQLDefender XDR, Advanced hunting

// SMB connections from the device: the file servers it reachedDeviceNetworkEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RemotePort == 445 and ActionType == "ConnectionSuccess"| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), Connections = count() by RemoteIP, RemoteUrl

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Map Network Drive MRU shows.

MountPoints2Shows the share was actually mounted for this user, and when they last connected.
Share Access on the File Server, Security Event 5140Not in the RegistryConfirms on the server that the share was opened, and by which account, if auditing is on.

Sources

The facts on this page come from these public pages, which say more on each point.