Microsoft Shared Folder & Unknown Registry Key

Hello

A couple of questions

1) What is the purpose of the C:\Program Files\Common Files\Microsoft Shared
folder and why do programs get installed to the folder ?

2) I noticed this registry key
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC ...what is the purpose of this CPC key ? it has a Volume sub key.

C:\Program Files\Common Files\Microsoft Shared

Program Files stores Application programs.

Common Files stores various common program files.

Common Files\Microsoft Shared stores shared files for Microsoft programs.

Programs do not get installed there, unless maybe malware, files like .dll
files or .lex files (Dictionary Files), etc. do.

mount
To place a removable tape or disc into a drive.

dismount
To remove a removable tape or disc from a drive.

mounted drive
A drive attached to an empty folder on an NTFS volume. Mounted drives
function the same as any other drive, but are assigned a label or name
instead of a drive letter. The mounted drive's name is resolved to a full
file system path instead of just a drive letter. Members of the
Administrators group can use Disk Management to create mounted drives or
reassign drive letters.

Removable Storage
A service used for managing removable media (such as tapes and discs) and
storage devices (libraries). Removable Storage allows applications to access
and share the same media resources.

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPo
ints2\CPC
Subkeys that start with # are paths to drives that have been mounted

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPo
ints2\CPC\Volume,User Activity,Each GUID subkey includes a Data value. This
value is a volume identifier.

HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
Explorer\MountPoints2\CPC\Volume\

The first key contains a list of mounted devices, with associated persistent
volume name and unique internal identifier for respective devices. This key
lists any volume that is mounted and assigned a drive letter, including USB
storage devices and external DVD/CDROM drives. From the listed registry
values, values name that starts with \DosDevices\! and ends with the
associated drive letter, contains information regarding that particular
mounted device. For instance, if the binary data for registry value
\DosDevices\F! contains \??\Storage#RemoveableMedia! at the beginning of the
value, it signifies a USB removable disk was connected to the system USB
port. By correlating the entry with registry key LastWrite time,
investigator would know when the removable device is connected. The second
key also contains similar information as MountedDevices key,which is located
under the respective device GUID (Globally Unique Identifiers) subkey and in
the binary registry value named Data.

--
Hope this helps. Let us know.

Wes
MS-MVP Windows Shell/User

In news:D19FE1ED-3203-4B5B-BD91-69C7B609FE3A@microsoft.com,
Marbles <Marbles DeleteThis @discussions.microsoft.com> hunted and pecked:
> Hello
>
> A couple of questions
>
> 1) What is the purpose of the C:\Program Files\Common Files\Microsoft
> Shared
> folder and why do programs get installed to the folder ?
>
> 2) I noticed this registry key
>
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPo
ints2\CPC
> ...what is the purpose of this CPC key ? it has a Volume sub key.