Computer Name

The host name, so you can confirm the image is the machine you think it is.

Use it to confirm the image comes from the machine you think it does, by the host name it is set to.

  • SYSTEM
  • System Information

What It Is

This key holds the name the machine is set to use on the network, its computer name. An investigator reads it to confirm an image came from the machine they think it did, by matching the name against event logs, EDR records and email headers. It holds the configured name, so a rename waiting for a restart already shows the new name. It lives in the SYSTEM hive.

What It Proves

The name the machine uses, which you can match to event logs, EDR records and email headers.

What It Does Not Prove

It holds the configured name, so a rename waiting for a restart already shows the new one. Earlier names are not kept here.

Where It Lives

Computer Name lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Control\ComputerName\ComputerName
Hive file: C:\Windows\System32\config\SYSTEM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Computer Name, each with what it tells you
Registry ValueWhat It Tells You

ComputerName

REG_SZWS-042

The machine is named WS-042, the NetBIOS form Windows keeps in capitals. Check it against the evidence record before you trust anything else in the image.

Tcpip\Parameters\Hostname

REG_SZws-042

The DNS host name is ws-042. Search logs and EDR records for this form as well as the NetBIOS name.

Tcpip\Parameters\Domain

REG_SZcorp.example

The DNS suffix is corp.example, so the full name is ws-042.corp.example. Search mail headers and proxy logs for the full name too.

How to Read It

Read SYSTEM\Select first, because its Current value gives the control set in use, usually 001. Open ComputerName\ComputerName and read the ComputerName value. Check Services\Tcpip\Parameters for Hostname and Domain, the DNS form of the name.

When Windows Writes It
Windows writes it when the machine is named or renamed, and a rename takes effect at the next boot.
Which Windows Versions
Windows XP to 11
Tools That Parse It
Registry Explorer, RECmd, RegRipper (compname)

Hunt It

The host name sits in this key, not in an event, so read it from the SYSTEM hive, offline or live with Velociraptor. It then matches the Computer field that Windows writes into every event log record.

Sees Related ActivityDeviceInfo (documentation, opens in a new tab)

Gives the name Defender knows the device by. It does not read the key, but a mismatch is worth explaining.

KQLDefender XDR, Advanced hunting
// The name, platform and users Defender last saw for the deviceDeviceInfo| where Timestamp > ago(7d)| where DeviceName startswith "ws-042"| summarize arg_max(Timestamp, *) by DeviceId| project Timestamp, DeviceName, OSPlatform, OSBuild, PublicIP, LoggedOnUsers

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Computer Name shows.

  • Network Interfaces (Tcpip)Gives the address the host last held, to match it in network records too.
  • Computer Field in Every Event Log RecordNot in the RegistryShows the name in use when each event was logged, so a rename shows up with its date.

Sources

The facts on this page come from these public pages, which say more on each point.