ComputerName Registry Key

The ComputerName registry key will provide the Computer Name of the endpoint.

Analysis Value

🖥️pageSystem Enumeration

Operating System Availability

Major VersionSupportMajor VersionSupport

Windows 11

✅

Server 2019

✅

Windows 10

✅

Server 2016

✅

Windows 8

✅

Server 2012

✅

Windows 7

✅

Server 2008

✅

Windows Vista

✅

Server 2003

✅

Windows XP

✅

Artifact Location(s)

  • File: %SystemRoot%\System32\config\SYSTEM

  • Key: SYSTEM\{CURRENT_CONTROL_SET}\Control\ComputerName\ComputerName

For more information on determining the correct CurrentControlSet, visit Select Registry Key

Artifact Parsers

  • RegistryExplorer (Eric Zimmerman)

Artifact Interpretation

The ComputerName value's data field will provide the system's configured Computer Name.

Example

PS> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" -Name *

ComputerName : HLPC01

This example was produced on Windows 10, Version 10.0.19044 Build 19044

Last updated