# NetworkCards Registry Key

The `NetworkCards` registry key will provide the name and interface GUID of the system's attached network interface adatpers.

## Analysis Value

{% content-ref url="../../artifacts-by-activity/system-enumeration" %}
[system-enumeration](https://psmths.gitbook.io/windows-forensics/artifacts-by-activity/system-enumeration)
{% endcontent-ref %}

## Operating System Availability

| Major Version | Support | Major Version | Support |
| ------------- | ------- | ------------- | ------- |
| Windows 11    | ✅       | Server 2019   | ✅       |
| Windows 10    | ✅       | Server 2016   | ✅       |
| Windows 8     | ✅       | Server 2012   | ✅       |
| Windows 7     | ✅       | Server 2008   | ✅       |
| Windows Vista | ✅       | Server 2003   | ✅       |
| Windows XP    | ✅       |               |         |

## Artifact Location(s)

{% tabs %}
{% tab title="🔌 Offline System" %}

* File: `%SystemRoot%\System32\config\SOFTWARE`
* Key: `SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\*`
  {% endtab %}

{% tab title="🔋 Live System" %}

* `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\*`
  {% endtab %}
  {% endtabs %}

## Artifact Parsers

* RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation

Each network interface adapter will have its own subkey with the following values:

* `Description`: The name of the network adapter
* `ServiceName`: The GUID of the network adapter

## Examples

```
Description     REG_SZ      Microsoft Hyper-V Network Adapter
ServiceName     REG_SZ      {4C7FB48D-33EB-4277-A3FB-37D5EF39C990}
```

This example was produced on Windows Server 2019 Standard, Version 10.0.17763 Build 17763

```
Description     REG_SZ      Realtek USB GbE Family Controller
ServiceName     REG_SZ      {737FB1FE-88FF-4F5E-943A-A46C057E68B9}
```

This example was produced on Windows 10, Version 10.0.19044 Build 19044