Select Registry Key
The Select
registry key provides the number of the system's CurrentControlSet
. The CurrentControlSet
contains important configuration for the Windows operating system, and several different Control Sets may be available within a system's registry.
In general, ControlSet001
will be the most recent Control Set that has been booted under, whereas ControlSet002
functions as a backup of a known-good state for the Control Set.
Analysis Value
🖥️pageSystem EnumerationOperating System Availability
Major Version | Support | Major Version | Support |
---|---|---|---|
Windows 11 | ✅ | Server 2019 | ✅ |
Windows 10 | ✅ | Server 2016 | ✅ |
Windows 8 | ✅ | Server 2012 | ✅ |
Windows 7 | ✅ | Server 2008 | ✅ |
Windows Vista | ✅ | Server 2003 | ✅ |
Windows XP | ✅ |
Artifact Location(s)
File:
%SystemRoot%\System32\config\SYSTEM
Key:
SYSTEM\Select
Artifact Parsers
RegistryExplorer (Eric Zimmerman)
Artifact Interpretation
Within the Select
key, the value named Current
identifies the CurrentControlSet
by an integer. If the value is 1
for instance, that means that the CurrentControlSet
on a live system will point to ControlSet001
.
Example
In the following example, the Select
value's data is 1
, indicating that the CurrentControlSet is ControlSet001
.
This example was produced on Windows 10, Version 10.0.19044 Build 19044
Last updated