Wireless Security S...
 
Notifications
Clear all

Wireless Security Settings

14 Posts
10 Users
0 Reactions
1,293 Views
(@chris2792)
Eminent Member
Joined: 18 years ago
Posts: 33
Topic starter  

All,

I'm trying to determine what kind of Wireless Security (if any) has been used on a Laptop (OS is WindowsXP) from an Encase Image.

I would need information where in the registry these settings are stored and how to identify if WEP/WPA/WPA2/NONE has been used, if possible for both cases (when Zero Config Service from Windows is used as opposed to the use of the vendor provided Software)

Thank you

Chris


   
Quote
(@kovar)
Prominent Member
Joined: 18 years ago
Posts: 805
 

Greetings,

I'm also curious how to go about this via an image.

Would booting the image in a virtual machine with all external access disabled and checking directly work for you?

-David


   
ReplyQuote
(@Anonymous)
Guest
Joined: 1 second ago
Posts: 0
 

http//msdn2.microsoft.com/en-us/library/aa916274.aspx

It's in
HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC\Parameters


   
ReplyQuote
(@chris2792)
Eminent Member
Joined: 18 years ago
Posts: 33
Topic starter  

Would booting the image in a virtual machine with all external access disabled and checking directly work for you?

I don't think that would work. In a virtual machine there's no Wireless Hardware, so you cant click on Interface->properties …

HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC\Parameters

These settings are only used when the Zero Config Service from windows is used, nothing there when you use the Vendor provided Software.


   
ReplyQuote
(@dronsenn)
New Member
Joined: 17 years ago
Posts: 1
 

Hello, everyone!

I've got another question what about Windows Vista? There's no such key (HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC) in Vista.

Where can I find information on Wireless Networks in Windows Vista registry? Should I see it in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wlansvc?

Thanks


   
ReplyQuote
(@rarosalion)
Eminent Member
Joined: 17 years ago
Posts: 28
 

I'm also trying to find this information on a vista system, and have no WZCSVC key. The wireless adapter seems to be configured using the Intel ProWireless software, but I still can't find any registry keys/config files which list and SSIDs.

Did anyone ever solve this one?


   
ReplyQuote
(@douglasbrush)
Prominent Member
Joined: 16 years ago
Posts: 812
 

One way to test this is to install Windows fresh/naked on a system without the wifi card installed (most laptops will allow easy access to the internal wifi card from a cover on the bottom of the system). Use RegShot - http//sourceforge.net/projects/regshot/ to take a snapshot of the reg. Install the card and drivers and connect to a wifi network and then do another RegShot to compare keys.


   
ReplyQuote
thelama
(@thelama)
New Member
Joined: 17 years ago
Posts: 3
 

For the Vista/Windows 7 wireless info, the key(s) are at

SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles.

For more check out Mark's post on creating a parser for it.

http//cfed-ttf.blogspot.com/2009/08/decoding-datecreated-and.html


   
ReplyQuote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

http//msdn2.microsoft.com/en-us/library/aa916274.aspx

It's in
HKEY_LOCAL_MACHINE\Software\Microsoft\WZCSVC\Parameters

Right, and it's specific to Windows Mobile/Windows CE Embedded.


   
ReplyQuote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

For the Vista/Windows 7 wireless info, the key(s) are at

SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\NetworkList\\Profiles.

For more check out Mark's post on creating a parser for it.

http//cfed-ttf.blogspot.com/2009/08/decoding-datecreated-and.html

That parser is specific to the date/time data within the values, and not about security settings.


   
ReplyQuote
Page 1 / 2
Share: