MountPoints2 is a Windows registry key that stores information about mounted volumes, removable media and some network resources. It helps Windows remember drive mappings and shell behaviour, while also providing forensic evidence of connected devices and accessed locations.
What MountPoints2 Records and Why It Matters
MountPoints2 is a Windows registry location that records mounted volumes, removable media and some network resources. It helps the shell remember drive mappings and access behaviour, and it often preserves traces of what was connected to the system.
From a security perspective, that makes it useful in both administration and investigation. The key is not just that Windows stores mount history, but that the record can outlast the device itself, creating a durable view of prior storage activity and location access.
How Windows Uses MountPoints2
Windows uses this registry data to support user convenience and shell state. When a drive letter, removable device or mapped resource has been seen before, the operating system can reuse stored information to restore familiar behaviour rather than treating each connection as entirely new.
That convenience comes with persistence. Registry artefacts like MountPoints2 can survive across logons and may remain present even after a device is unplugged, which is why they are often examined during incident response and endpoint triage.
Forensic Value of the Artefact
MountPoints2 is valuable because it can corroborate device history, user activity and filesystem interaction. It may help answer questions such as whether USB storage was attached, whether a mapped location was used, or whether a system previously interacted with a removable or network resource.
In practice, it is rarely treated as a standalone proof source. Investigators usually pair it with other artefacts such as shellbags, setup logs, USB-related registry keys and file system metadata so they can distinguish a brief connection from sustained use.
Why This Registry Key Is Security-Relevant
Because the key reflects connected storage and accessed locations, it can expose operational patterns that an attacker or investigator may care about. A workstation that routinely mounts removable media, or a system that remembers a network share, reveals more about local behaviour than a casual inspection of open windows would show.
That makes the artefact useful for detection, but it also means its presence can indicate exposure to removable-media workflows, shadow copy of user activity, or possible movement of data across trust boundaries. The record is often more valuable for corroboration than for isolation.
For broader control context, Windows artefact handling sits inside endpoint hardening and audit discipline described in NIST SP 800-53 Rev 5 Security and Privacy Controls, and strong baseline configuration practices are reinforced by CIS Benchmarks.
Risk and Threat Considerations
MountPoints2 can leak behavioural history and help an attacker infer which devices, shares or locations a system has interacted with. That matters in post-compromise review because the artefact may reveal removable-media use, staging paths or prior access to resources that were not meant to be obvious.
Failure mechanism: Windows preserves mount and mapping evidence in a persistent registry location, so an exposed endpoint can retain clues about device history even after the original media is gone.
Impact: An adversary or investigator can use that persistence to reconstruct user activity, identify likely exfiltration paths, or validate whether a host touched specific removable or network resources.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | MountPoints2 is a forensic artefact used to reconstruct device and location history. |
| CM-6 — Configuration Settings | The key reflects Windows shell behaviour and persisted mount state created by configuration. | |
| Recommendation — Correlate MountPoints2 with other audit artefacts to validate device-access events. Standardise endpoint configuration so mount artefacts are predictable and reviewable. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | MountPoints2 supports investigation and review of endpoint activity. |
| CIS-4 — Secure Configuration of Enterprise Assets and Software | The registry behaviour depends on Windows endpoint configuration and hardening. | |
| Recommendation — Retain and review endpoint artefacts that help reconstruct access to removable media. Harden Windows endpoints so persistent user and device artefacts are controlled and expected. | ||
Practitioner Guidance
What to watch for: Treat MountPoints2 as one corroborating artefact in a wider endpoint review, not as a standalone conclusion. It is most useful when aligned with USB history, shell artefacts, execution traces and file access evidence.
Practitioner takeaway: If you are reviewing a suspicious Windows host, preserve registry evidence early, then interpret MountPoints2 alongside the rest of the artefact set so you do not overstate or understate what the system actually saw.