ComputerName Registry Key

The ComputerName registry key will provide the Computer Name of the endpoint.

Analysis Value

Operating System Availability

Artifact Location(s)

  • File: %SystemRoot%\System32\config\SYSTEM

  • Key: SYSTEM\{CURRENT_CONTROL_SET}\Control\ComputerName\ComputerName

For more information on determining the correct CurrentControlSet, visit Select Registry Key

Artifact Parsers

  • RegistryExplorer (Eric Zimmerman)

Artifact Interpretation

The ComputerName value's data field will provide the system's configured Computer Name.


PS> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" -Name *

ComputerName : HLPC01

This example was produced on Windows 10, Version 10.0.19044 Build 19044

Last updated