Knock, knock! Who's there?

Dealing with OS and Identity

The Case Of… Windows 7 Network Connections empty folder

The Case Of… Windows 7 Network Connections empty folder

  • Comments 28
  • Likes

Well... this is not an Identity Management specific post, but I would like to make my blog more content wide and cover other areas of work and experience, so here it goes the first non-Identity post :).

For some unknown reason, it happened to me that my “Network Connections” folder in Windows 7 x64 got empty., Network connections all still work, and I could even go and change some settings through netsh, but I was commited to fix the issue. Hitting refresh button updated the status line of the window with “0 connections” message.

After some “Bingging” ;-), I found similar issues and fixes for XP both in Microsoft Support Knowlege Base and some forums that were not applicable.

System reboots, updating network drivers, removing and adding interfaces in Device Manager, removing network services related stuff such as network virtualization bridges, re-registering netshell.dll, netcfgx.dll and netman.dll, adding Network Service account to Local Administrators group (this one fixed another “Network and Sharing Center” empty screen issue in the past) were not helpful neither.

Normally system restore points will have being really helpful here, but due to lack of disk space, I had not enough restore points to get back to a healthful state, specially after last three Windows Update packages came through.

So after several hours and system reboots I was almost ready to give up when I decided to give Process Monitor and myself a last chance before rebuilding my system. I added svchost.exe and svchost.exe’s instance that holds “Network Connections” service (NetMan) in ProcMon filters, like this:


I just got the needed svchost.exe instance PID by looking for Netman service in Process Explorer tooltip, like this:


Then I looked at registry calls when hitting refresh button in ncpa.cpl window (that is how you can launch “Network Connections” dialog quickly) and comparing it with the same activity in a healthy system.

While the healthy system registry activity queried for NIC information in the registry, my faulty system was giving a BUFFER OVERFLOW result when quering for HKLM\SYSTEM\CurrentControlSet\Control\Network\Connections\ClassManagers value. A simple look to this value seems fine, but when I edited it I just found that for some reason the faulty system had all 4 GUIDs ({B4C8DF59-D16F-4042-80B7-3557A254B7C5},{BA126AD3-2166-11D1-B1D0-00805FC1270E},{BA126AD5-2166-11D1-B1D0-00805FC1270E} and {BA126ADD-2166-11D1-B1D0-00805FC1270E}) in a single line, instead of in separate lines of this REG_MULTI_SZ value as it should be.

So just fixing the REG_MULTI_SZ value to a proper format and hitting refresh in “Network Connections” dialog made network connection icons come back again!

Hope this helps.

  • Juanand-

    I am a novice computer guy (just run my own small business) and having this issue with Network Connections Folder.

    I'm quite sure the solution you outline above will fix my problem, but I'm not sophisticated enough to get into where you mvoe the 4 GUIDs to separate lines.

    Any chance you'd be interested in walking me through this?  My email is


    -Brian Reich

  • Brian, check the following video:


  • I have the same problem - network connections are empty - however my registry key appears to be correct. I was going to use your idea of using process explorer but i'm not sure how i find the instance of svchost that holds the network connections service. Could you tell me how i can narrow that down? When i run process explorer and just include svchost, it still generates thousands of entries.


  • merk,

    Please check that the GUIDs are in separate lines. By just browsing to the value in regedit.exe it appears to be fine. It is when you double-click to edit when it shows up as a single line.

    Regarding using SysInternals tools, I did the following:

    - Within Process Explorer, mouse-over svchost.exe processes until I found "Network Connections [netman]" service in the svchost.exe's tooltip. That is the svchost.exe PID you want to monitor. In the above picture, 964 was my PID.

    - Add PID 964 in Process Monitor (procmon), rather than process name "svchost.exe". This will narrow down procmon traces to the svchost.exe instance that is running "Network Connections" service.

    To get as less noise as possible in procmon traces, you may also want to stop those services shown in Process Explorer tooltip that you are not interested in, such as "Distributed Link Tracking Svc" , "Desktop Window Manager Session Manager" or "Human Interface Device Access" services in the picture above, except those that may have dependencies with the service you are looking at.

    Hope this helps.

    Good luck!

  • juanand,

    thanks for the reply. Yup, i did dbl click and it is on separate lines.

    Regarding process explorer - maybe we have different versions or something. When i run process explorer, it literally generates thousands of entries within a few seconds. It's not very practical to mouse over them all trying to find the right one. I did try it anyhow hoping i'd stumble on the right one but they all showed the same info when i moused over them. I thought perhaps there was some way within process explorer to filter all that out. I used process explorer once or twice in the past i don't remember it generating so many entries.

    Actually, i just realized i was confusing process monitor with process explorer. I was just able to use proc explorer to get the PID i needed.

    Proc monitor then turned up these errors:

    not found: HKLM\System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{B9DDDB2A-DD95-45E5-8AE3-A5D6098B5C50}\Connection\MediaSubType



    HKCU\Software\Microsoft\RAS AutoDial\Default\DefaultInternet

    buffer overflow:


    access denied:

    HKLM\Software\Microsoft\RAS AutoDial

    If you have any ideas on if any of those might be the cause and what would be the solution, i'm all ears :)


  • merk,

    I would suggest the following steps:

    - Open procmon and user filters to look for "Network Connections" svchost.exe's PID.

    - Set procmon to pause (Ctrl+E), that is, not capturing yet.

    - Open "Network Connections" folder showing empty issue and leave it open.

    - Switch to procmon and enable registry tracing.

    - Go to "Network Connections" folder and hit F5 key to refresh.

    Then repeat the steps in a healthy system, and look for differences.

    By your comments:

    Not found: HKLM\System\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{B9DDDB2A-DD95-45E5-8AE3-A5D6098B5C50}\Connection\MediaSubType

    -> Not all network adapters show up MediaSubType value for me. I also get not found for some guids.

    Not found: HKLM\System\CurrentControlSet\Control\WMI\Security\5b23f342-8421-42ef-87eb-3b686f5a1b2a

    -> Did not found that registry lookup neither similar WMI related in my system.

    Not found: HKU\S-1-5-18_Classes

    -> I also have this in my system.

    Not found: HKCU\Software\Microsoft\RAS AutoDial\Default\DefaultInternet

    -> I do have this value.

    buffer overflow:


    -> This is my main suspect. In my case, it tries to read it twice with this error, but third time it gets success. This value seems to be related to available network services for your interfaces, such as network monitor filter, virtualization network drivers (VirtualPC, VirtualBox, VMware...), virtual wifi (softAP), etc. If you do not end up getting a SUCCESS, check if you recently installed one of these things and try to uninstall them.

    access denied: HKLM\Software\Microsoft\RAS AutoDial

    -> In my system I do not get this, but HKCU\Software\Microsoft\RAS AutoDial queries with SUCCESS as result.

    Good luck!

  • HKLM\System\CurrentControlSet\Control\Network\Config

    Do you actually have that key in the registry? because i just checked the registry and for me, i do not have it.

    thanks again

  • Actually it is not a key, it is a binary value under HKLM\System\CurrentControlSet\Control\Network\ key.

    You may want to export this value from a working computer and import it in the problematic one and check if it fixes the problem.

    From my tests, renaming the value and restarting recreates the value (different data, though), but the "Network Connections" folder and interfaces properties pages seem ok.

  • Finally!

    Been trying to resolve this problem for since yesterday afternoon, but renaming the 'HKLM\System\CurrentControlSet\Control\Network\Config' binary value has now fixed it for me.


  • Congrats! :)

  • I had the same problem. Procmon showed that svchost was getting buffer overflow when reading HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\Config. I renamed that registry entry and pressed F5 in Network Connections. Presto-changeo the Config key was recreated and the network coonections screen was populated again. My guees is that the config key is a cache for Network Connections wizard and it gets corrupted somehow. When I renamed it, it was recreated from scratch.

  • renaming the config binary key solved my problem of the loc. connection window being empta, and the wifi system icon turning into bars, when the connection is made.

    Thank you guys!

  • got an asus ul30a laptop with Windows 7 64bit and had the same problem with empty Network Connections folder. Changing the name of the Config binary key helped !!! Config key is recreated after changing.

    Although I am realy curiouse what causes this problem. The config key created 2nd time is different from the old/1st.

    Awsome... Thanks a lot to all who helped.

  • Arranging the 4 GUID on new lines worked !!!! THANKS !!!

  • Renaming HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\Config worked for me.  Running 64-bit Windows 7.  Thanks for the tip.

Your comment has been posted.   Close
Thank you, your comment requires moderation so it may take a while to appear.   Close
Leave a Comment