Find Network Protocols in Windows Regedit

This article explains how to locate the list of installed network protocols and transport providers using the Windows Registry Editor (Regedit). You will find the exact registry paths responsible for storing the Windows Sockets (Winsock) protocol catalog, network provider priority orders, and installed network transport components.

1. Winsock Protocol Catalog and Transport Providers

The primary location for installed network protocols and transport service providers used by Windows Sockets is located under the Winsock2 service key.

• Registry Path:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries

Under this key, you will see numbered subkeys (such as 000000000001, 000000000002). Each entry represents an installed transport protocol or layered service provider (LSP), including TCP/IP, UDP, and raw sockets. The PackedCatalogItem binary value inside each subkey contains the provider’s configuration and driver path.

For 32-bit protocols on a 64-bit operating system, the corresponding list is found at: * 32-Bit Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries64

2. Network Protocol Component Definitions

To view installed network protocol drivers and components registered with the Windows network stack, navigate to the network class GUID for protocols:

• Registry Path:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}

Each subkey under this GUID corresponds to an installed network protocol (such as IPv4, IPv6, or Link-Layer Topology Discovery). Selecting a subkey displays its display name, driver descriptions, and configuration parameters.

3. Network Providers and Priority Order

Windows manages network providers (such as the Microsoft Windows Network or Remote Desktop Network Provider) through a specific control key that defines active providers and their binding order:

• Provider Order Key:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\NetworkProvider\Order
• Value Name: ProviderOrder
  This string contains a comma-separated list of installed and active network provider services (for example, LanmanWorkstation,RDPNP).

To inspect the detailed configuration of an individual provider listed in the order string, check its service entry: * Registry Path:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<ProviderName>\NetworkProvider

4. TCP/IP Protocol Parameters

For core TCP/IP stack configuration, interface bindings, and transport parameters, Windows stores settings under the main network service keys:

• IPv4 Parameters:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
• IPv6 Parameters:
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters