Network
Every network joined, wired, Wi-Fi or VPN, with first and last connection times.
Use it to place a laptop on a network, by name and gateway MAC, with the first and last time it connected.
- SOFTWARE
- Network History
What It Is
NetworkList is where Windows records every network the machine has joined, wired, Wi-Fi or VPN, with the first and last time it connected to each. It names each network as that network called itself, and a companion Signatures key adds the gateway's MAC address, which can pin down where the network was. It helps place a laptop on a network at a time, to check a story of where it has been. It lives in SOFTWARE.
What It Proves
The machine joined a network with that name, first at DateCreated and last at DateLastConnected. Signatures add the gateway MAC, which can place the network.
What It Does Not Prove
The dates are in local time, not UTC, so take off the offset in force on each date, an hour under British Summer Time, before you put them on a UTC timeline. A name is only what the network called itself.
Where It Lives
NetworkList lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The laptop joined a network called HotelGuest-5G. A name is only what the network called itself, so back it up with the gateway MAC and the DHCP domain. |
| It first connected 7 Oct 2026 at 19:05 local time, 18:05 UTC under BST. Convert with the time zone key before it goes on the timeline. |
| It last connected 10 Oct 2026 at 07:42 local time, 06:42 UTC under BST. The DHCP lease in the Tcpip key has the same minute, so the two agree. |
| The gateway's MAC is 84:D8:1B:3A:5E:10, from Signatures\ |
How to Read It
In the Profiles subkey, each network has ProfileName, NameType (0x47 for Wi-Fi, 0x06 for wired, 0x17 for VPN) and Category (0 public, 1 private, 2 domain). DateCreated and DateLastConnected are 16-byte SYSTEMTIME values in local time, so convert each to UTC with the offset the time zone key gives for that date. Match the ProfileGuid in NetworkList\Signatures\Managed or Unmanaged, beside Profiles, for the DefaultGatewayMac and DnsSuffix values.
- When Windows Writes It
- When the machine first joins a network, and on every later connection.
- Which Windows Versions
- Windows 7 to 11
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (networklist)
Hunt It
Which networks a machine joined sit in this key and are not an event of their own, so parse SOFTWARE, or read it live with Velociraptor. Event 8001 in the Microsoft-Windows-WLAN-AutoConfig/Operational log records each Wi-Fi connection.
Reports networks while the device is onboarded and inside retention. Older networks are only in the hive.
// Networks the device reported, with first and last seenDeviceNetworkInfo| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what NetworkList shows.
- Network Interfaces (Tcpip)Gives the address, gateway and DHCP domain, which check what the network name claims.
- WLAN AutoConfig Event 8001Not in the RegistryLogs each Wi-Fi connection with a UTC time, a check on these local dates.
- SRUM Network UsageNot in the RegistryShows how much data each program sent on that network, for about the last month.
Sources
The facts on this page come from these public pages, which say more on each point.