Current Control Set (Select)
Which ControlSet00x holds the settings in use, so you read the right one offline.
Use it to find which ControlSet00x held the live settings, so you read the right one in an offline SYSTEM hive.
- SYSTEM
- System Information
What It Is
The SYSTEM hive keeps more than one control set, each a copy of the machine's service and driver settings, and the Select key says which one is in use. When you read an offline hive it is the first thing to check, because it names the set that a running system calls CurrentControlSet, so you read the right one. Most machines have only ControlSet001. It lives in the SYSTEM hive.
What It Proves
Current names the control set Windows booted with, so ControlSet00<Current> is what a running system calls CurrentControlSet. The other values name the sets for the next boot and for recovery.
What It Does Not Prove
It tells you where to look, not what happened. Most modern systems have only ControlSet001, but skipping this step on an image with two sets gives wrong answers.
Where It Lives
Current Control Set (Select) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Windows booted with ControlSet001, so read it wherever a guide says CurrentControlSet. Reading another set by mistake gives the wrong services and devices. |
| The next boot would also use ControlSet001, so no switch was pending. A different number would mean a pending change, so compare the two sets. |
| The recovery copy is ControlSet001 too, so no older set is in use. If a ControlSet002 exists, compare it for settings that changed. |
| No control set is marked as failed to boot. A non-zero value would name one that failed, so compare it with the current set for the change behind it. |
How to Read It
Read Current, where 1 means ControlSet001 holds the settings in use. Default names the set for the next boot, LastKnownGood the one kept for recovery, and Failed names one that did not boot, if any. CurrentControlSet exists only while Windows runs, so a guide that names it means ControlSet00<Current> in a hive.
- When Windows Writes It
- At boot, and when Windows marks a set as failed or last known good.
- Which Windows Versions
- Windows XP to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper
Hunt It
Which set is in use sits in the Select key, not in an event, so read it from the SYSTEM hive. A live tool reads CurrentControlSet directly, so this step matters mainly for an offline image.
Defender does not report the control set. Live tools read CurrentControlSet directly, while for an image you read SYSTEM\Select.
Parse the Hive Instead
- Collect
C:\Windows\ System32\ config\ SYSTEM - Parse With
- Registry ExplorerRECmdRegRipper
Sources
The facts on this page come from these public pages, which say more on each point.