Recover a list of Windows shares from a crashed server

Recover a list of Windows shares from a crashed server

This post is intended for our field technicians and our more technical customers. 

We recently got a request from a new customer to assist in recovering data and shares from an old Windows server that had crashed. The operating system was completely unstable outside of safe mode, so the normal procedures to review the shares were unavailable.

The matter was complicated further as the logical volume holding the data (and the associated shares) had already been removed from the server.

If you find yourself in this situation you can access the following registry key under LOCAL_MACHINE:

HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Shares

This registry location will list the various attributes of the shares including the share name and location. Unlike other methods, reviewing the share list from the registry does not depend on other Windows components such as the Server service to be running.