Feature Update History (Source OS)

One subkey per feature update, keeping the details of the Windows build it replaced.

Use it to date each Windows feature update and find the original install, so you know which builds to expect.

SYSTEM
System Information

What It Is

When Windows runs a feature update it copies the previous build's details aside, keeping one subkey, Source OS, per update. Those subkeys date each feature update, and the oldest gives the original install date and build, so you know which artefacts to expect. Monthly updates leave no subkey. It lives in the SYSTEM hive.

What It Proves

The machine was upgraded on that date from the build recorded in the subkey. The oldest subkey gives the original install date and build.

What It Does Not Prove

Only feature updates leave a subkey, not monthly updates, and a clean install has none. The date in the key name is written month first.

Where It Lives

Feature Update History (Source OS) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\Setup\Source OS (Updated on <date>)

C:\Windows\System32\config\SYSTEM

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Feature Update History (Source OS), each with what it tells you
Registry Value	What It Tells You
`Source OS (Updated on 9/3/2026 02:14:37)` `SubkeyCurrentBuild 19045, DisplayVersion 22H2`	Windows was upgraded on 3 Sep 2026 from Windows 10 22H2, build 19045. Check the old hives in Windows.old for activity before that date.
`Source OS (Updated on ...)\InstallDate` `REG_DWORD0x63f39600`	Windows 10 was installed 20 Feb 2023 15:47 UTC. It is the only subkey, so this is the original install, which you can check against the asset record.

How to Read It

Each Source OS subkey copies the old CurrentVersion values, such as ProductName, CurrentBuild, DisplayVersion or ReleaseId, and InstallDate. InstallDate in each subkey is when that older build was installed, in Unix seconds (UTC). Sort the subkeys by InstallDate, where the oldest is the original install and each later one an upgrade.

When Windows Writes It: At each feature update, when setup copies the old build details aside.
Which Windows Versions: Windows 10 and 11, after an in-place upgrade
Tools That Parse It: Registry Explorer, RECmd

Hunt It

The upgrade history sits in this key, so parse the SYSTEM hive, or read it live with Velociraptor. The update logs in C:\Windows\Panther corroborate when a build landed.

Sees Related ActivityDeviceInfo

Advanced hunting keeps 30 days, so this catches only a recent upgrade. The Source OS keys go back to the first install.

KQLDefender XDR, Advanced hunting

// When each Windows build was first and last reported for the deviceDeviceInfo| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp) by OSBuild, OSVersionInfo| order by FirstSeen asc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Feature Update History (Source OS) shows.

Windows Version and Install TimeGives the current build and when it was installed, the end of this history.
Device Migration (LastPresentDate)Was written during the same update, so it confirms one ran.
Windows.old Folder From the Previous BuildNot in the RegistryConfirms the update, and holds the old build's hives with activity from before it.

Sources

The facts on this page come from these public pages, which say more on each point.