Wi-Fi Profiles (Wlan
Each Wi-Fi network saved on the machine, with the number SRUM uses to name it.
Use it to tie SRUM network usage to a named Wi-Fi network, through the ProfileIndex each saved profile holds.
- SOFTWARE
- Network History
What It Is
For each Wi-Fi network the machine has saved, the WlanSvc service keeps a profile here, holding the network name and the index number that SRUM uses to label it. Through the ProfileIndex each profile holds, the key ties SRUM's network usage to a named Wi-Fi network. Its own times are weak, so take connection times from elsewhere. It lives in SOFTWARE.
What It Proves
The machine saved a profile for that Wi-Fi network, and ProfileIndex matches L2ProfileId in SRUM, which ties network usage to it.
What It Does Not Prove
Its only times are key last write times, when Windows last changed each key, which Microsoft does not document as connection times. A deleted profile leaves no key, though NetworkList and SRUM may still name the network.
Where It Lives
Wi-Fi Profiles (WlanSvc) lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| This profile is L2ProfileId 268435459 in SRUM's network tables. Use it to total the data sent and received on this network. |
| The profile is for HotelGuest-5G, the network name in plain ASCII inside the data. NetworkList and the DHCP domain name the same hotel network. |
| The profile key last changed 7 Oct 2026 18:05 UTC, matching NetworkList's first connection in UTC. Treat it as a lead and confirm it with WLAN AutoConfig event 8001 in the Operational log. |
| MetaData last changed 10 Oct 2026 06:42 UTC, matching the last NetworkList connection in UTC. A match supports the timeline but does not date the connection. |
How to Read It
Each profile GUID subkey holds a ProfileIndex, and its MetaData subkey holds Channel Hints, which carries the network name. ProfileIndex matches L2ProfileId in SRUM, which ties network usage to the named network. Take connection times from NetworkList and from WLAN AutoConfig event 8001 in the Microsoft-Windows-WLAN-AutoConfig/Operational log, and treat the profile and MetaData key times only as leads.
- When Windows Writes It
- When a Wi-Fi profile is saved, and whenever Windows changes it or its MetaData.
- Which Windows Versions
- Windows 8 to 11
- Tools That Parse It
- Registry Explorer, RECmd, SrumECmd
Hunt It
The saved profiles sit in this key, so parse SOFTWARE, or read it live with Velociraptor. Event 8001 in the Microsoft-Windows-WLAN-AutoConfig/Operational log records each Wi-Fi connection.
Reports Wi-Fi networks while the device is onboarded and inside retention. Older networks are only in the hive.
// Wi-Fi networks the device reported, with first and last seenDeviceNetworkInfo| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Wi-Fi Profiles (WlanSvc) shows.
- NetworkListGives first and last connection dates, which these key times are not.
- SRUM Extensions (Table GUIDs)Points to the SRUM network tables, where ProfileIndex shows the data used.
- Profile XML Files in C:\ProgramData\Microsoft\Wlansvc\ProfilesNot in the RegistryHolds each saved profile in full, a second record that the network was saved.
Sources
The facts on this page come from these public pages, which say more on each point.