Where WSL Network Mode Config Is Stored in Registry

Windows Subsystem for Linux (WSL) relies on user-level configuration files for preference selection, but Windows manages and reflects active networking modes (such as NAT, Mirrored, Bridged, and DNS tunneling) directly inside the Windows Registry. This article details the exact registry paths used by the Host Network Service (HNS), Hyper-V Virtual Switch, and LXSS subsystem to maintain active WSL network configurations.

1. Host Network Service (HNS) Active State

The runtime networking mode for WSL 2 is managed dynamically by the Windows Host Network Service. Regedit stores the active endpoints, network IDs, and policy configurations under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hns\State

Within this path: * Networks: Contains active GUIDs representing the WSL virtual network (e.g., Default Switch or Mirrored Network). * Endpoints: Contains the specific IP bindings, MAC addresses, and assigned policies for running WSL instances.

2. Virtual Switch Configuration

When WSL initializes a network mode (such as standard NAT or bridged networking), it binds to a virtual switch managed by the Virtual Machine Switch Management Provider (VMSMP). The active switch properties are located at:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\VMSMP\Parameters\SwitchList

Each subkey represents an active or configured virtual switch, detailing its internal interface name, switch type, and physical adapter binding (relevant for Bridged mode).

3. Network Interface and IP Stack Parameters

The actual network interface parameters generated for WSL adapters (like vEthernet (WSL)) are mapped to the TCP/IP stack in the following location:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{GUID}

Here, the system stores runtime networking details including assigned IP addresses, subnets, gateways, and DNS server configurations deployed for the active session.

4. WSL Subsystem and Distribution Registry Keys

General configuration flags and registered distributions for WSL are stored under the current user hive:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Lxss

While individual distribution flags reside here under separate GUID keys, system-wide networking mode directives (such as networkingMode=mirrored or networkingMode=NAT) originate from the %USERPROFILE%\.wslconfig file and are translated by the subsystem into the HNS and VMSMP registry states upon launch.