ComputerName Registry Key

The ComputerName registry key will provide the Computer Name of the endpoint.

Analysis Value

🖥️System Enumeration

Operating System Availability

Major Version	Support	Major Version	Support
Windows 11	✅	Server 2019	✅
Windows 10	✅	Server 2016	✅
Windows 8	✅	Server 2012	✅
Windows 7	✅	Server 2008	✅
Windows Vista	✅	Server 2003	✅
Windows XP	✅

Artifact Location(s)

🔌 Offline System

• File: %SystemRoot%\System32\config\SYSTEM

• Key: SYSTEM\{CURRENT_CONTROL_SET}\Control\ComputerName\ComputerName

🔋 Live System

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName

For more information on determining the correct CurrentControlSet, visit Select Registry Key

Artifact Parsers

• RegistryExplorer (Eric Zimmerman)

Artifact Interpretation

The ComputerName value's data field will provide the system's configured Computer Name.

Example

PS> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" -Name *

ComputerName : HLPC01

This example was produced on Windows 10, Version 10.0.19044 Build 19044