Network Interfaces (Tcpip)

The last IP address, DHCP server, gateway and domain for each network adapter.

Use it to find the last IP address, DHCP server and domain each adapter used, to place the machine on a network.

SYSTEM
Network History

What It Is

Under the Tcpip service, Windows keeps the current network settings for each adapter, such as the last IP address, DHCP server, gateway and domain. Those settings help place the machine on a network at the time, especially the DHCP domain, which often names the organisation or venue. Each adapter is a subkey under Interfaces, named by its GUID. It lives in the SYSTEM hive.

What It Proves

The adapter last held that address on a network that handed out that DHCP domain, within the lease times shown.

What It Does Not Prove

It mostly keeps only the latest settings for each adapter, though Windows 8 and later keep a few earlier networks in child subkeys. Private addresses rarely place a machine on their own.

Where It Lives

Network Interfaces (Tcpip) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\<interface GUID>

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Network Interfaces (Tcpip), each with what it tells you
Registry Value	What It Tells You
`DhcpIPAddress` `REG_SZ203.0.113.87`	The Wi-Fi adapter last held 203.0.113.87, its DHCP lease on the hotel network. In the office, ws-042 uses 192.0.2.42, the address the Active Directory events show. An address alone rarely places a machine, so pair it with the DHCP domain and the lease times.
`DhcpDomain` `REG_SZguest.harbourhotel.example`	The network handed out guest.harbourhotel.example, a hotel guest network rather than the office. It backs up the HotelGuest-5G entry in NetworkList.
`LeaseObtainedTime` `REG_DWORD0x6ac9de6a`	The lease was taken 10 Oct 2026 06:42 UTC, the same minute as the last NetworkList connection. Two artefacts agreeing makes the timeline stronger.

How to Read It

Match the interface GUID to an adapter with NetworkCards in SOFTWARE. Read DhcpIPAddress, DhcpServer, DhcpDefaultGateway and DhcpDomain. LeaseObtainedTime and LeaseTerminatesTime are Unix seconds, in UTC.

When Windows Writes It: Each time the adapter gets or renews an address.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Registry Explorer, RECmd, RegRipper (nic2)

Hunt It

The last address an adapter held sits in this key, not in an event, so parse the SYSTEM hive, or read it live with Velociraptor. Pair it with the DHCP domain and lease times rather than trusting an address alone.

Sees Related ActivityDeviceNetworkInfo

Defender reports adapter settings as they change. It does not read the Tcpip keys, which keep the last values long after.

KQLDefender XDR, Advanced hunting

// Addresses, gateways and DNS servers the device reported per adapterDeviceNetworkInfo| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| project Timestamp, NetworkAdapterName, MacAddress, IPAddresses, DefaultGateways, DnsAddresses, ConnectedNetworks| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Network Interfaces (Tcpip) shows.

NetworkListNames the network and gives the dates it was first and last joined.
SRUM Network UsageNot in the RegistryShows which programs used the network, and how much data each sent.

Sources

The facts on this page come from these public pages, which say more on each point.