How to interpret the NT network registry

1. The physical device entries are stored along with all other devices in:
   "HKLM\Software\Microsoft\Windows NT\CurrentVersion\NetworkCards" + NN
   Where:
   NN enumerates each installed network adapter
   e.g. "1" or "10"
2. Each of these device instance registry keys has a "ServiceName" registry value
   Where:
   "ServiceName" == "DeviceNN" which points to the specific service instance for the device
   e.g. "EPRO1" or "NdisWan5"
   
3. The device driver service entry is stored in:
   "HKLM\System\CurrentControlSet\Services\" + DEVICE
   Where:
   DEVICE is a vendor defined key unique to each device driver
   
4. Within the DEVICE registry key, there is a "Linkage" registry key.
   Within "Linkage", there is a "Bind" MULTI_SZ string value.
   "Bind" contains a list of strings, one entry for each each adapter instance.
   e.g. ("NdisWan1", "NdisWan4", "NdisWan5")
   This points to a list of device instances controlled by this driver.
   "HKLM\System\CurrentControlSet\Services\" + DeviceNN
   
5. Under each device instance registry key, there is a "Parameters" key.
   This is where all the NDIS configuration parameters are stored for the device.
   

Each vendor will have a software registry key for each device type installed:
"HKLM\Software" + VENDOR\DEVICE
Under this key there is a "NetRules" key which is used by the binding engine.

If you remove all the network adapters, all the "NetworkCards\NN" keys and their corresponding "...Services\DeviceNN" , "...Services\Device", and "...Software\VENDOR\DEVICE" keys should be deleted. If these are left dangling, you must delete them before trying to reinstall any network components.

After adding or deleting any network component on NT, you must restart. Otherwise NT will get confused and may corrupt your registry.

Back to Resources