I have an Vista OS image, and it is crucial to that case to know the mac address from the ethernet device. It was stored in a registy key in older OS but it doesn't happen anymore.
Does anybody have a clue?
Thanks
ARP cache? Not sure, I'm sliding towards "you're boned"
You get the MAC of the default gateway for each profile under HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures.
One thing you could do that comes to mind - take a Vista box with a known MAC of a NIC and search (prob want to use some sort of regex to account for formatting and encoding) and see where it shows up. Just a thought…
I can't speak for vista, but I have been able to pull a mac address out of the windows evt logs from an XP system.
The best chance is in ObjectIDs which you will find in the MFT or more easily in link files on an NTFS system.
All explained in the
H
You get the MAC of the default gateway for each profile under HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures.
Thats the mac of the wireless ap (in most cases). So no good here, but if you have the router it was connected to you could look at the logs on that.
Thats the mac of the wireless ap (in most cases).
Yes, or the wired link.
There is no registry store of local MACs dependent on the OS, as the questioner would have assumed if he was referring to local devices. The MAC of a particular NIC can be found under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\nnnn\ as "NetworkAddress" or under any subkey or not at all, from Win2000 to 7. That depends on the device driver and its configuration.