Find Virtual Switch Extensions in Regedit

This article explains how to locate the list of registered Hyper-V virtual network switch extension filtering modules in the Windows Registry using Regedit. System administrators and network engineers often need to inspect these registry paths to verify third-party filter drivers, troubleshoot Hyper-V extensible switch issues, or audit installed network capture, filtering, and forwarding extensions.

Primary Registry Path for Virtual Switch Extensions

The registered virtual network switch extensions for Microsoft Hyper-V are located under the Virtual Machine Switch Management Protocol (VMSMP) service key.

To view them in the Windows Registry Editor:

1. Press Win + R, type regedit, and press Enter.

2. Navigate to the following path:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMSMP\Parameters\SwitchExtensions

Under the SwitchExtensions key, you will see subkeys named after the unique Globally Unique Identifiers (GUIDs) representing each installed extension.

Identifying Extension Details

Each GUID subkey under SwitchExtensions contains values that describe the extension module:

• ExtensionType: Specifies the type of switch extension.
  • 1 = Capture Extension
  • 2 = Filtering Extension
  • 3 = Forwarding Extension
• FriendlyName: The display name of the extension (e.g., Microsoft Windows Filtering Platform, NDIS Capture LightWeight Filter).
• VendorName: The provider or manufacturer of the extension.
• Version: The driver version of the installed module.

Related Network Filter Registry Path

Hyper-V switch extensions are implemented as NDIS 6.0 (or later) lightweight filter (LWF) drivers. You can cross-reference registered filter drivers by navigating to the network component class key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}

This section stores configuration information for all installed network protocols and filter drivers across the operating system.

Verification via PowerShell

If you need to verify the registry values from the command line without opening Regedit directly, run the following PowerShell command as Administrator:

Get-VMSwitchExtension

This command queries the same registry settings and lists all installed, enabled, and disabled virtual switch extensions, including their extension type and module path.