Interfaces Registry Key
The Interfaces
registry key will provide information regarding the systems attached network interface adatpers, such as IP address and MAC address.
Analysis Value
🖥️pageSystem EnumerationOperating System Availability
Major Version | Support | Major Version | Support |
---|---|---|---|
Windows 11 | ✅ | Server 2019 | ✅ |
Windows 10 | ✅ | Server 2016 | ✅ |
Windows 8 | ✅ | Server 2012 | ✅ |
Windows 7 | ✅ | Server 2008 | ✅ |
Windows Vista | ✅ | Server 2003 | ✅ |
Windows XP | ✅ |
Artifact Location(s)
File:
%SystemRoot%\System32\config\SYSTEM
Key:
SYSTEM\{CURRENT_CONTROL_SET}\Services\Tcpip\Parameters\Interfaces\{INTERFACE_GUID}
For more information on determining the correct CurrentControlSet
, visit Select Registry Key
For more information on {INTERFACE_GUID}
, visit NetworkCards Registry Key
Artifact Parsers
RegistryExplorer (Eric Zimmerman)
Artifact Interpretation
Each interface will have its own dedicated registry key, and may contain the following values of interest:
value | type | information |
---|---|---|
DhcpDomain | REG_SZ | DHCP option 15 - the domain name of the endpoints FQDN |
DhcpIPAddress | REG_SZ | The DHCP - provided IP address of the endpoint |
DhcpServer | REG_SZ | The DHCP server that provided the endpoint its network configuration |
EnableDHCP | REG_DWORD | 0x0 if DHCP is disabled and 0x1 if DHCP is enabled |
LeaseObtainedTime | REG_DWORD | FILETIME timestamp of when the endpoint received a DHCP lease |
LeaseTerminatesTime | REG_DWORD | FILETIME timestamp of when the endpoint's DHCP lease expires |
Example
Correlating with the NetworkCards registry key:
This example was produced on Windows 10, Version 10.0.19044 Build 19044
Last updated