# ComputerName Registry Key

The `ComputerName` registry key will provide the Computer Name of the endpoint.

## Analysis Value

{% content-ref url="../../artifacts-by-activity/system-enumeration" %}
[system-enumeration](../../artifacts-by-activity/system-enumeration)
{% endcontent-ref %}

## Operating System Availability

| Major Version | Support | Major Version | Support |
| ------------- | ------- | ------------- | ------- |
| Windows 11    | ✅       | Server 2019   | ✅       |
| Windows 10    | ✅       | Server 2016   | ✅       |
| Windows 8     | ✅       | Server 2012   | ✅       |
| Windows 7     | ✅       | Server 2008   | ✅       |
| Windows Vista | ✅       | Server 2003   | ✅       |
| Windows XP    | ✅       |               |         |

## Artifact Location(s)

{% tabs %}
{% tab title="🔌 Offline System" %}
* File: `%SystemRoot%\System32\config\SYSTEM`
* Key: `SYSTEM\{CURRENT_CONTROL_SET}\Control\ComputerName\ComputerName`
{% endtab %}

{% tab title="🔋 Live System" %}
* `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName`
{% endtab %}
{% endtabs %}

{% hint style="info" %}
For more information on determining the correct `CurrentControlSet`, visit [select](select "mention")
{% endhint %}

## Artifact Parsers

* RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation

The `ComputerName` value's data field will provide the system's configured Computer Name.

## Example

```
PS> Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName" -Name *

ComputerName : HLPC01
```

This example was produced on Windows 10, Version 10.0.19044 Build 19044
