DNS by Jared Crandall on Dec 2013

How to Find a Network Adapter in the Registry

Many times I have found it needful to be able to find what adapters are loaded on a server, whether they are not showing up in device manager, I wanted to validate whether network teaming was enabled, I wanted to see if some firewall miniport driver was installed, I wanted to see if the local Antivirus added anything, or any other reason. Here are some steps I have found helpful when validating what Network adapters are enumerated by the OS.

DISCLAIMER: (This is mostly the common Microsoft Disclaimer for editing the registry) This section, method, or task contains steps that tell you how to modify/review the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756  (http://support.microsoft.com/kb/322756/ ) How to back up and restore the registry in Windows

Step-By-Step

  • Open the Network control panel (one way you can do this is by going to a run command and entering ncpa.cpl)
  • If this fails in Vista/2008/Win7 find cmd.exe (in %windir%system32), right click then Run as Administrator and enter Admin account if needed
  • If this fails in XP/2003 find cmd.exe (in %windir%system32), right click then Run as and enter Admin account
  • At the new administrative command prompt enter: ncpa.cpl
  • In the Network Connections window note the names of the network adapters (Should be something like “Intel 21140-Based PCI Fast Ethernet Adapter”)
  • Launch the Registry editor by going to a run command and entering: Regedit
  • If this fails in Vista/2008/Win7 find cmd.exe (in %windir%system32), right click then Run as Administrator and, if needed, enter Admin account
  • If this fails in XP/2003 find cmd.exe (in %windir%system32), right click then Run as and enter Admin account
  • At the new administrative command prompt enter: Regedit
  •  The first step will be to find the correct interface. To do this browse to the following location in Regedit.
    • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlClass{4D36E972-E325-11CE-BFC1-08002bE10318} 
    • Add this location to your favorites.
  • Highlight key then go to Favorites on the menu and click Add to Favorites…. I use the name “HAL Net Adapters”
  • In this location you will find a number of folders (numbered 0000-9999) each referring to a network adapter (some of which are physical or virtual interfaces).
  • Open each of these and look at the value with in DriverDesc that matches something like “Intel 21140-Based PCI Fast Ethernet Adapter” (in most cases reflects the name in the network control panel or device manager for your adapter)
  • Quite a few of these are mini-port drivers and PPP endpoints, so it helps when looking for anything that is “non-standard” to have a baseline to go off of, I use a clean build VM to do all this.
  • Once you find the adapter you are looking for, copy the value of the NetCfgInstanceId out to notepad, as you will need this later. This is the interface GUID
  • Now navigate to the following in Regedit:
    • In XP:
      • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpipParametersInterfaces
    • In Vista/2008/Win 7:
      • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip4ParametersInterfaces
  • or (depending on the protocol you are concerned about)
    • HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6ParametersInterfaces
  •  Add this location to your favorites.
  • Highlight key then go to Favorites on the menu and click Add to Favorites…. I use the name “IP (4/6) Interfaces”
  • In this location you will find a number of folders; look for one who’s name matches the GUID earlier copied to notepad. (If you do not find your GUID listed here then you may have picked interface that does not actually exist, repeat the steps above and this time look for the GUIDs located in the …tcpip(4/6)interfaces key hive to match to the value of NetCfgInstanceId )
  • Once you open the interface GUID key you will see a good number of settings that you can configure. I will cover what these are and how they are set in a future post. If you find one you are not sure of it meaning try searching on TechNet.