Mount
Volumes and network shares this user had mounted, which ties a USB stick to a person.
Use it to tie a USB stick or network share to the user who had it mounted, and when they last did.
- NTUSER.DAT
- USB Devices
What It Is
MountPoints2 is the per-user record of the volumes and network shares a user has mounted, which Explorer keeps so it can offer them again. Because it is in the user's own NTUSER.DAT, it is the key that ties a USB stick or a share to a person, through the volume GUID the stick was given in MountedDevices. A subkey for a share names a server the user reached, which can be a sign of moving from one machine to another.
What It Proves
The user was logged on while a volume with that GUID was mounted, and the subkey's last write time marks their last connection. Share subkeys name the servers the user reached.
What It Does Not Prove
A device plugged in after a logoff can land in the last user's hive. UASP disks do not appear to get a volume GUID, so tie those to a user through logon times.
Where It Lives
MountPoints2 lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
NTUSER.DAT\C:\What It Looks Like
These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The SanDisk stick was last connected at 15 Oct 2026 16:28 UTC while alice was logged on. That ties it to her session, so check her logon events cover the time. |
| alice reached the C$ admin share on srv-fin-01, last at 14 Oct 2026 22:19 UTC. That is three minutes after her Remote Desktop session there, a sign of moving between machines. |
How to Read It
Each subkey is a volume GUID or a share path, so match the GUID to MountedDevices to name the device. A subkey such as ##srv-fin-01#c$ is a mounted admin share, which can be a sign of moving between machines. The subkey's last write time is the user's last connection to that volume or share.
- When Windows Writes It
- When a volume or share is mounted while the user is logged on.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (mp2)
Hunt It
Which volume a user had mounted is kept only in this per-user key, so parse NTUSER.DAT, or run Velociraptor across the endpoints. A share subkey can be corroborated by logon events on the named server.
Defender does not read MountPoints2. Interactive logons show who could have used the volume at the time.
// Who was logged on interactively: set beside the MountPoints2 timesDeviceLogonEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what MountPoints2 shows.
- MountedDevicesTurns the volume GUID into a device, and the drive letter it had.
- ShellBagsShows the user browsed folders on that volume, not just had it mounted.
- Logon Sessions, Security Event 4624Not in the RegistryShows who was logged on when the volume mounted, in case it landed in the wrong user's hive.
Sources
The facts on this page come from these public pages, which say more on each point.