Find Virtual Display Drivers in Regedit

This guide outlines the precise Windows Registry paths where registered virtual display drivers (Indirect Display Drivers) and video capture pipelines are stored. By navigating these specific registry keys using the Registry Editor (regedit.exe), system administrators and developers can identify, audit, and troubleshoot virtual display hardware and software-based capture filters.

Virtual Display Drivers Registry Paths

Windows manages display drivers, including virtual and Indirect Display Driver (IDD) instances, under specific system class and device enumeration keys.

1. Display Adapter Class Key

The primary location for installed display drivers and virtual display adapters is:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}

• Navigate through the numeric subkeys (e.g., 0000, 0001, 0002).
• Check the string value DriverDesc or ProviderName to locate virtual display drivers (such as those using the IddCx Indirect Display Driver framework, Parsec, spacedesk, or Citrix).

2. Software Device Enumeration (SWD)

Software-created virtual display devices are enumerated under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\SWD\DRIVERENUM

• Look for subkeys containing virtual monitor devices and indirect display adapters.

3. Active Graphics Drivers Configuration

Global settings and runtime parameters for graphics adapters and indirect displays are stored in:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\GraphicsDrivers

Capture Pipelines Registry Paths

Capture pipelines, including DirectShow video capture filters, Media Foundation transforms, and desktop capture mechanisms, are cataloged under standard COM/system class identifiers.

1. DirectShow Video Capture Sources (Virtual Cameras and Pipelines)

Software-based video capture pipelines and virtual capture sources registered as DirectShow filters are located at:

• 64-bit Pipelines: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance
• 32-bit Pipelines: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Classes\CLSID\{860BB310-5D01-11d0-BD3B-00A0C911CE86}\Instance

Each subkey under Instance represents a registered video capture source, containing details such as FriendlyName and CLSID.

2. Windows Media Foundation Capture Transforms

Media Foundation-based capture pipelines and frame processing transforms are registered at:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\MediaFoundation\Transforms

• Subkeys categorize video processors, encoders, and capture processing nodes used by the modern Windows capture stack.

3. Desktop Duplication and DWM Capture Configuration

Pipeline behaviors for Desktop Window Manager (DWM) frame capture and graphics streaming can be reviewed at:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Dwm

How to Inspect the Keys

1. Press Win + R, type regedit, and press Enter.
2. Paste any of the paths above directly into the address bar at the top of the Registry Editor.
3. Examine the FriendlyName, DriverDesc, and CLSID values within each subkey to locate specific software devices or capture pipelines.