Windows OS Details

WINDOWS OS DETAILS

Note: This section details important Windows operating system information across many different versions such as: Windows XP, 7, 10, 11, and Windows Server. Details in this section include version number and dates released, administrative binary information, environmental variables, important registry locations and more.

Note: Windows 10 versions include Home, Pro, Education, Enterprise, Pro for Workstations, Pro Education, Windows 10 S, and Windows 10 Enterprise LTSC

Note: Windows servers include Windows Server Essentials, Windows Server Standard, Windows and Server Datacenter.

ID	VERSION
NT 3.1	Windows NT 3.1 (All)
NT 3.5	Windows NT 3.5 (All)
NT 3.51	Windows NT 3.51 (All)
NT 4.0	Windows NT 4.0 (All)
NT 5.0	Windows 2000 (All)
NT 5.1	Windows XP (Home, Pro, MC, Tablet PC, Starter, Embedded)
NT 5.2	Windows XP (64-bit, Pro 64-bit)
NT 5.2	Windows Server 2003 & R2 (Standard, Enterprise)
NT 5.2	Windows Home Server
NT 6.0	Windows Vista (Starter, Home, Basic, Home Premium, Business, Enterprise, Ultimate)
NT 6.0	Windows Server 2008 (Foundation, Standard, Enterprise)
NT 6.1	Windows 7 (Starter, Home, Pro, Enterprise, Ultimate)
NT 6.1	Windows Server 2008 R2 (Foundation, Standard, Enterprise)
NT 6.2	Windows 8 (x86/64, Pro, Enterprise, Windows RT (ARM))
NT 6.2	Windows Phone 8
NT 6.2	Windows Server 2012 (Foundation, Essentials, Standard)
NT 6.3	Windows 8.1 (Pro, Enterprise)
NT 10	Windows 10 version 1507

EXECUTABLE	NAME
lusrmgr.msc	Local user and group manager
services.msc	Services control panel
taskmgr.exe	Task manager
secpol.msc	Local security policy editor
eventvwr.msc	Event viewer
regedit.exe	Registry editor
gpedit.msc	Group policy editor
control.exe	Control panel
ncpa.cpl	Network connections manager
devmgmt.msc	Device manager editor
diskmgmt.msc	Disk manager editor

ENVIRONMENT VARIABLE	DESCRIPTION AND LOCATION
%SYSTEMROOT%	Points to Windows folder (Commonly: C:\Windows)
%APPDATA%	Points to user roaming directory Commonly (C:\Users<USERNAME>\AppData\Roaming)
%COMPUTERNAME%	The computer hostname
%HOMEDRIVE%	Points to default OS drive (Commonly: C:\ )
%HOMEPATH%	Points to user directory (Commonly: C:\Users<USERNAME> )
%PATH%	When a command is run without a full path (for example: ipconfig) the OS searches all file paths contained in the PATH environmental variable for this file
%PATHEXT%	When a command is run without an extension (for example: ipconfig) the OS searches for file matches that INCLUDE extensions from this PATHEXT list
%SYSTEMDRIVE%	Points to default OS drive (Commonly: C:\ )
%TMP% && %TEMP%	Points to user temp folders (Commonly: C:\Users<USERNAME>\AppData\Local\Temp)
%USERPROFILE%	Points to user directories (Commonly: C:\Users<USERNAME> )
%WINDIR%	Points to Windows directory (Commonly: C:\Windows)
%ALLUSERSPROFILE%	Points to Windows directory (Commonly: C:\ProgramData Windows 10+)

Note: All file paths marked “(WinXP)” are Windows XP only. All others are tested and working with Windows 10+.

LOCATION	FILE CATEGORY
%SYSTEMROOT%\System32\drivers\etc\hosts	DNS entries
%SYSTEMROOT%\System32\drivers\etc\networks	Network settings
%SYSTEMROOT%\System32\config\SAM	User & password hashes
%SYSTEMROOT%\repair\SAM	Backup copy of SAM (WinXP)
%SYSTEMROOT%\System32\config\RegBack\SAM	Backup copy of SAM
%WINDIR%\System32\config\AppEvent.Evt	Application Log (WinXP)
%WINDIR%\System32\config\SecEvent.Evt	Security Log (WinXP)
%WINDIR%\System32\config\SECURITY	Security Log
%WINDIR%\System32\config\APPLICATION	Application Log
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\	Startup Location (WinXP)
%USERPROFILE%\Appdata\Roaming\Microsoft\Windows\Start Menu\Programs\Startup	Startup Folder
%WINDIR%\Panther\	Commonly used unattend install files
%WINDIR%\System32\Sysprep	Commonly used unattend install files
%WINDIR%\kb*	Installed patches (WinXP)

Note: Some of these keys are also reflected under HKLM\Software\WOW6432Node on systems running a 64-bit version of Windows.
Note: Windows Sysinternals Autoruns is an excellent utility to inspect and monitor auto-starting locations on Windows.
- Available at https://technet.microsoft.com/en-us/sysinternals/

List of registry keys accessed during system boot (in load order):
(WinXP) HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
HKLM\System\CurrentControlSet\Services \ Start value of 0 = Kernel Drivers (Load before Kernel initiation) \ Start value of 2 = Auto-Start \ Start value of 3 = Manual-Start
(WinXP) HKLM\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
(WinXP) HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
HKLM\Software\Microsoft\Windows\CurrentVersion\RunServices
HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
(WinXP) HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v Userinit
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell
HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon /v Shell
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
(WinXP) HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
(WinXP) HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
(WinXP) HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\load
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler (XP, NT, W2k only)