Windows Version and Install Time
Edition, release and build, and when the current build was installed.
Use it to identify the exact Windows build, so you know which artefacts to expect, and when it was installed.
- SOFTWARE
- System Information
What It Is
This key holds the exact version of Windows the machine runs, its edition, release and build number, with the date the current build was installed. Knowing the build tells you which artefacts to expect, because features and their records change between builds. The install date also bounds when the machine was set up or last upgraded. It lives in SOFTWARE under CurrentVersion.
What It Proves
Which Windows build the machine runs, so which artefacts to expect, and when that build was installed.
What It Does Not Prove
InstallDate is usually the last feature update, not the first install. Windows 11 still reads Windows 10 in ProductName, so trust CurrentBuild for the real version.
Where It Lives
Windows Version and Install Time lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| ProductName says Windows 10 Pro, which Windows 11 still reports. Trust CurrentBuild for the real version. |
| Build 26100 is Windows 11 24H2. Expect each artefact in its Windows 11 form, such as BAM under its State key. |
| This build was installed 3 Sep 2026 at 02:14 UTC, usually by a feature update rather than a fresh install. Check the Source OS keys for the builds before it. |
| Before that update the machine ran build 19045, Windows 10 22H2. Its old hives may survive in Windows |
How to Read It
CurrentBuild and UBR give the build and its monthly update level, which together name the exact version, and a CurrentBuild of 22000 or above is Windows 11. DisplayVersion, such as 24H2, names the release from Windows 10 20H2 onwards, and older builds use ReleaseId. InstallDate is Unix seconds in UTC, usually the last feature update, not the first install, and the SYSTEM\Setup\Source OS keys hold the builds before it.
- When Windows Writes It
- Windows writes it at install and at every feature update, and the UBR value changes with the monthly updates.
- Which Windows Versions
- Windows XP to 11 keep it, and DisplayVersion appears from Windows 10 20H2.
- Tools That Parse It
- Registry Explorer, RECmd, RegRipper (winver)
Hunt It
The build and install date sit in this key, not in an event, so read it from SOFTWARE, offline or live with Velociraptor. Feature update history and the update logs corroborate when a build landed.
Reports the current build, not the install history.
// Windows platform and build as Defender last saw themDeviceInfo| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Windows Version and Install Time shows.
- Feature Update History (Source OS)Keeps one subkey per feature update, with the original install date and build.
- Windows.old Folder From the Previous BuildNot in the RegistryConfirms an upgrade replaced an earlier build, and holds that build's hives.
- Upgrade Logs in C:\Windows\PantherNot in the RegistryRecords the upgrade and its date, which explains an InstallDate later than the first install.
Sources
The facts on this page come from these public pages, which say more on each point.