...Or don't. Network Adapters in Windows Registry

Let's say you learned where Windows stores network card/adapter information in the registry, and you were playing with recovering a backup of Windows Server 2003 Active Directory to different, virtual hardware. Don't decide it a good idea to clean out the network adapters in the registry by uninstalling the virtual adapter and deleting all adapters in the registry. It's a bad idea.

I have been playing around with a few things: recovering Active Directory to different hardware (to a virtual PC/server), seizing FSMO (Flexible Single Master of Operations or operations master) roles, transferring operations master roles, a Windows Server 2008 R2 domain controller and adprep, and Domain Rename. I've done this three times successfully and once unsuccessfully.

During the unsuccessful attempt, I backed up the system state of our first production domain controller running Windows Server 2003 R2. I created a virtual machine running Windows Server 2003, placed it on a virtual switch not paired to a physical network card, and promoted it to a domain controller. I restarted in Active Directory Recovery Mode, restored the backup, and rebooted to Safe Mode. I had to repair Windows because I had restored an OEM copy of Windows Server 2003 R2 onto a volume license copy of Windows Server 2003. I uninstalled the network adapter from Device Manager and went into the registry and removed the network adapters. All I can say for certain is after restarting, Windows could not start the virtual network adapter. It said one or more files could not be found. I tried using the installation media and the local drive as the source for updated drivers and tried reinstalling the virtual machine additions, but it didn't help. My thought is that Active Directory is bound to network adapters. I notice domain controllers take longer to start up than other Windows Servers at the Preparing network connections phase of startup.

In some cases, this sort of difficulty would have me digging into the situation. In this case, my reaction was I'm not doing that again.

VirtualPC Virtual Network Adapters in Windows (Server 2008)

I am using a set of Microsoft VHDs to demo their software (specifically Microsoft Office Communication Server 2007 R2), and I wondered why my Local Area Connection was around Local Area Connection 24 and my network card was Microsoft Virtual Machine Bus Network 15. My guess is that Microsoft passed these VHDs around for review before release, so it stored past local area connections and network adapters. The Virtual Machines had a startup script called startup.cmd that referenced a Local Area Connection that wasn't the current one. I changed the number to match mine, then decided to remove the old adapters through the registry. Here's what I did (take caution and perform backups before editing the registry):

Under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Network Cards\, network cards are enumerated by number. The Description subkey lists the name of the adapter and the ServiceName subkey lists the Service GUID. I noted the ServiceName and deleted the keys.

For Windows Vista/Server 2008 and above, the keys under HKEY_LOCAL_MACHINE\Microsoft\Windows NT\Current Version\NetworkList\Profiles represent the networks. I deleted all but the network I was interested in (the domain). The network names are listed under Description and ProfileName. Interestingly, one of the networks was corp.microsoft.com.

Under HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}, network connections are listed (like Local Area Connection n) by GUID with their names under Connection\Name. I deleted all the GUIDs for the connections I didn't want.

Under HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Description, adapters are enumeratec and used the numbers are listed under the data of the REG_MULTI_SZ key. I cleared the data for Microsoft Virtual Machine Bus Network Adapter and Microsoft VMBus Network Adapter.

Under HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services are listed the the GUIDs representing the network cards from the ...Network Cards subkeys (ServiceName). I deleted the corresponding GUIDs from the Network Cards.

Under HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\Tcpip\Adapters are listed GUIDs representing adapters. I deleted the unwanted keys. The same is true for HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\Tcpip\Interfaces. I left HKEY_LOCAL_MACHINE\SYSTEM\Current Control Set\Services\Tcpip6\Parameters\Interfaces alone.

I found these Microsoft Knowledge Base articles, but they apply to NT 3.5 - 4.0:
http://support.microsoft.com/kb/146333
http://support.microsoft.com/kb/147797