The Case Of… Windows 7 Network Connections empty folder


Well... this is not an Identity Management specific post, but I would like to make my blog more content wide and cover other areas of work and experience, so here it goes the first non-Identity post :).

For some unknown reason, it happened to me that my “Network Connections” folder in Windows 7 x64 got empty., Network connections all still work, and I could even go and change some settings through netsh, but I was commited to fix the issue. Hitting refresh button updated the status line of the window with “0 connections” message.

After some “Bingging” ;-), I found similar issues and fixes for XP both in Microsoft Support Knowlege Base and some forums that were not applicable.

System reboots, updating network drivers, removing and adding interfaces in Device Manager, removing network services related stuff such as network virtualization bridges, re-registering netshell.dll, netcfgx.dll and netman.dll, adding Network Service account to Local Administrators group (this one fixed another “Network and Sharing Center” empty screen issue in the past) were not helpful neither.

Normally system restore points will have being really helpful here, but due to lack of disk space, I had not enough restore points to get back to a healthful state, specially after last three Windows Update packages came through.

So after several hours and system reboots I was almost ready to give up when I decided to give Process Monitor and myself a last chance before rebuilding my system. I added svchost.exe and svchost.exe’s instance that holds “Network Connections” service (NetMan) in ProcMon filters, like this:

image

I just got the needed svchost.exe instance PID by looking for Netman service in Process Explorer tooltip, like this:

image

Then I looked at registry calls when hitting refresh button in ncpa.cpl window (that is how you can launch “Network Connections” dialog quickly) and comparing it with the same activity in a healthy system.

While the healthy system registry activity queried for NIC information in the registry, my faulty system was giving a BUFFER OVERFLOW result when quering for HKLM\SYSTEM\CurrentControlSet\Control\Network\Connections\ClassManagers value. A simple look to this value seems fine, but when I edited it I just found that for some reason the faulty system had all 4 GUIDs ({B4C8DF59-D16F-4042-80B7-3557A254B7C5},{BA126AD3-2166-11D1-B1D0-00805FC1270E},{BA126AD5-2166-11D1-B1D0-00805FC1270E} and {BA126ADD-2166-11D1-B1D0-00805FC1270E}) in a single line, instead of in separate lines of this REG_MULTI_SZ value as it should be.

So just fixing the REG_MULTI_SZ value to a proper format and hitting refresh in “Network Connections” dialog made network connection icons come back again!

Hope this helps.

Comments (28)

  1. Juan Antonio Diaz - MSFT says:

    merk,

    I would suggest the following steps:

    – Open procmon and user filters to look for "Network Connections" svchost.exe’s PID.

    – Set procmon to pause (Ctrl+E), that is, not capturing yet.

    – Open "Network Connections" folder showing empty issue and leave it open.

    – Switch to procmon and enable registry tracing.

    – Go to "Network Connections" folder and hit F5 key to refresh.

    Then repeat the steps in a healthy system, and look for differences.

    By your comments:

    Not found: HKLMSystemCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}{B9DDDB2A-DD95-45E5-8AE3-A5D6098B5C50}ConnectionMediaSubType

    -> Not all network adapters show up MediaSubType value for me. I also get not found for some guids.

    Not found: HKLMSystemCurrentControlSetControlWMISecurity5b23f342-8421-42ef-87eb-3b686f5a1b2a

    -> Did not found that registry lookup neither similar WMI related in my system.

    Not found: HKUS-1-5-18_Classes

    -> I also have this in my system.

    Not found: HKCUSoftwareMicrosoftRAS AutoDialDefaultDefaultInternet

    -> I do have this value.

    buffer overflow:

    HKLMSystemCurrentControlSetControlNetworkConfig

    -> This is my main suspect. In my case, it tries to read it twice with this error, but third time it gets success. This value seems to be related to available network services for your interfaces, such as network monitor filter, virtualization network drivers (VirtualPC, VirtualBox, VMware…), virtual wifi (softAP), etc. If you do not end up getting a SUCCESS, check if you recently installed one of these things and try to uninstall them.

    access denied: HKLMSoftwareMicrosoftRAS AutoDial

    -> In my system I do not get this, but HKCUSoftwareMicrosoftRAS AutoDial queries with SUCCESS as result.

    Good luck!

  2. Juan Antonio Diaz - MSFT says:

    Brian, check the following video: http://www.youtube.com/watch?v=NUBVQEH1enU

    Thanks.

  3. Juan Antonio Diaz - MSFT says:

    Congrats! 🙂

  4. Anonymous says:

    got an asus ul30a laptop with Windows 7 64bit and had the same problem with empty Network Connections folder. Changing the name of the Config binary key helped !!! Config key is recreated after changing.

    Although I am realy curiouse what causes this problem. The config key created 2nd time is different from the old/1st.

    Awsome… Thanks a lot to all who helped.

  5. merk says:

    juanand,

    thanks for the reply. Yup, i did dbl click and it is on separate lines.

    Regarding process explorer – maybe we have different versions or something. When i run process explorer, it literally generates thousands of entries within a few seconds. It’s not very practical to mouse over them all trying to find the right one. I did try it anyhow hoping i’d stumble on the right one but they all showed the same info when i moused over them. I thought perhaps there was some way within process explorer to filter all that out. I used process explorer once or twice in the past i don’t remember it generating so many entries.

    Actually, i just realized i was confusing process monitor with process explorer. I was just able to use proc explorer to get the PID i needed.

    Proc monitor then turned up these errors:

    not found: HKLMSystemCurrentControlSetControlNetwork{4D36E972-E325-11CE-BFC1-08002BE10318}{B9DDDB2A-DD95-45E5-8AE3-A5D6098B5C50}ConnectionMediaSubType

    HKLMSystemCurrentControlSetControlWMISecurity5b23f342-8421-42ef-87eb-3b686f5a1b2a

    HKUS-1-5-18_Classes

    HKCUSoftwareMicrosoftRAS AutoDialDefaultDefaultInternet

    buffer overflow:

    HKLMSystemCurrentControlSetControlNetworkConfig

    access denied:

    HKLMSoftwareMicrosoftRAS AutoDial

    If you have any ideas on if any of those might be the cause and what would be the solution, i’m all ears 🙂

    thanks

  6. Juan Antonio Diaz - MSFT says:

    @StaVe,

    Just rename it to whatever you want so the system re-generates it again (my favourites are renaming by adding an underscore preffix or suffix, depending if I want it to be at the top of list of values or in its normal place.

    The idea of rename instead of delete it is to preserve its original values in case you need to revert back to them.

    Hope it helps.

  7. Juan Antonio Diaz - MSFT says:

    Actually it is not a key, it is a binary value under HKLMSystemCurrentControlSetControlNetwork key.

    You may want to export this value from a working computer and import it in the problematic one and check if it fixes the problem.

    From my tests, renaming the value and restarting recreates the value (different data, though), but the "Network Connections" folder and interfaces properties pages seem ok.

  8. merk says:

    I have the same problem – network connections are empty – however my registry key appears to be correct. I was going to use your idea of using process explorer but i’m not sure how i find the instance of svchost that holds the network connections service. Could you tell me how i can narrow that down? When i run process explorer and just include svchost, it still generates thousands of entries.

    thanks

  9. Juan Antonio Diaz - MSFT says:

    merk,

    Please check that the GUIDs are in separate lines. By just browsing to the value in regedit.exe it appears to be fine. It is when you double-click to edit when it shows up as a single line.

    Regarding using SysInternals tools, I did the following:

    – Within Process Explorer, mouse-over svchost.exe processes until I found "Network Connections [netman]" service in the svchost.exe’s tooltip. That is the svchost.exe PID you want to monitor. In the above picture, 964 was my PID.

    – Add PID 964 in Process Monitor (procmon), rather than process name "svchost.exe". This will narrow down procmon traces to the svchost.exe instance that is running "Network Connections" service.

    To get as less noise as possible in procmon traces, you may also want to stop those services shown in Process Explorer tooltip that you are not interested in, such as "Distributed Link Tracking Svc" , "Desktop Window Manager Session Manager" or "Human Interface Device Access" services in the picture above, except those that may have dependencies with the service you are looking at.

    Hope this helps.

    Good luck!

  10. merk says:

    HKLMSystemCurrentControlSetControlNetworkConfig

    Do you actually have that key in the registry? because i just checked the registry and for me, i do not have it.

    thanks again

  11. Brian Reich says:

    Juanand-

    I am a novice computer guy (just run my own small business) and having this issue with Network Connections Folder.

    I’m quite sure the solution you outline above will fix my problem, but I’m not sophisticated enough to get into where you mvoe the 4 GUIDs to separate lines.

    Any chance you’d be interested in walking me through this?  My email is breich@atratoadvisors.com

    Thanks.

    -Brian Reich

  12. alex says:

    Finally!

    Been trying to resolve this problem for since yesterday afternoon, but renaming the ‘HKLMSystemCurrentControlSetControlNetworkConfig’ binary value has now fixed it for me.

    Thanks.

  13. axel says:

    I had the same problem. Procmon showed that svchost was getting buffer overflow when reading HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig. I renamed that registry entry and pressed F5 in Network Connections. Presto-changeo the Config key was recreated and the network coonections screen was populated again. My guees is that the config key is a cache for Network Connections wizard and it gets corrupted somehow. When I renamed it, it was recreated from scratch.

  14. gforg says:

    renaming the config binary key solved my problem of the loc. connection window being empta, and the wifi system icon turning into bars, when the connection is made.

    Thank you guys!

  15. Shreeram Iyer (ASUS U50) says:

    Arranging the 4 GUID on new lines worked !!!! THANKS !!!

  16. EMW says:

    Renaming HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig worked for me.  Running 64-bit Windows 7.  Thanks for the tip.

  17. YG-DB says:

    No adaptors showing in Network Connections and unable to edit access networking tab of VPN connection.

    Renaming HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig worked, Windows 7 Starter – HP netbook

    Thanks!

  18. BAM45 says:

    No config shown in HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetwork. running windows 7 64 bit.

    any ideas?

  19. StaVe says:

    Yeah I understood that you have to rename this config think but you rename it to what? Please help, I've been trying to solve this think for ages!

  20. Chuck says:

    Renaming HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig worked for me.  Running 64-bit Windows 7 Professional SP1 on a Lenovo ThinkPad laptop.

    Note: I modified the REG_MULTI_SZ value to the proper format but that did not resolve the issue.

    Thanks for the tips all.

  21. John says:

    Renaming HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig worked for me win 7 32bit,  thankyou!

  22. doe says:

    renaming HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig  also worked for me

  23. Josh says:

    Hi There,
    I am getting the same issue – Done all the obvious (like you stated in the first part – i.e. updates, reboots etc.)
    I have checked that the Class Managers is all on their separate line
    I have also deleted and renamed config, to no avail.

    Any ideas?!

    Thanks

  24. Daralen Manta says:

    Unfortunately, ConnectionsClass Managers was already set on separate lines and renaming NetworkConfig then refreshing the network connections window for me didn't resolve the issue. I'll try Process Explorer to see if I can narrow down where the problem
    is occurring.

  25. Terry McG says:

    HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig rename & in Network Connections worked for me as well (Win7 32 bit) – many thanks for the pointers!

  26. QatarSupport says:

    go to HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetwork on the right pane look for "config" and rename it. It also worked in windows 2012 R2. thank you guys …..

  27. Dave says:

    I spent hours trying to solve this problem. I have minimal computer skills but stumbled across this page and gave the registry edit a try. I renamed HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlNetworkConfig , rebooted my machine, and things were
    back to normal. Thank you so much!

Skip to main content