# Select Registry Key

The `Select` registry key provides the number of the system's `CurrentControlSet`. The `CurrentControlSet` contains important configuration for the Windows operating system, and several different Control Sets may be available within a system's registry.

In general, `ControlSet001` will be the most recent Control Set that has been booted under, whereas `ControlSet002` functions as a backup of a known-good state for the Control Set.

## Analysis Value

{% content-ref url="../../artifacts-by-activity/system-enumeration" %}
[system-enumeration](../../artifacts-by-activity/system-enumeration)
{% endcontent-ref %}

## Operating System Availability

| Major Version | Support | Major Version | Support |
| ------------- | ------- | ------------- | ------- |
| Windows 11    | ✅       | Server 2019   | ✅       |
| Windows 10    | ✅       | Server 2016   | ✅       |
| Windows 8     | ✅       | Server 2012   | ✅       |
| Windows 7     | ✅       | Server 2008   | ✅       |
| Windows Vista | ✅       | Server 2003   | ✅       |
| Windows XP    | ✅       |               |         |

## Artifact Location(s)

{% tabs %}
{% tab title="🔌 Offline System" %}
* File: `%SystemRoot%\System32\config\SYSTEM`
* Key: `SYSTEM\Select`
{% endtab %}

{% tab title="🔋 Live System" %}
* `HKEY_LOCAL_MACHINE\SYSTEM\Select`
{% endtab %}
{% endtabs %}

## Artifact Parsers

* RegistryExplorer (Eric Zimmerman)

## Artifact Interpretation

Within the `Select` key, the value named `Current` identifies the `CurrentControlSet` by an integer. If the value is `1` for instance, that means that the `CurrentControlSet` on a live system will point to `ControlSet001`.

## Example

In the following example, the `Select` value's data is `1`, indicating that the CurrentControlSet is `ControlSet001`.

```
PS> Get-ItemProperty -Path "HKLM:\SYSTEM\Select" -Name *

Current       : 1
Default       : 1
Failed        : 0
LastKnownGood : 1
```

This example was produced on Windows 10, Version 10.0.19044 Build 19044
