Where WSL Network Mode Is Stored in Registry

This article explains where the Windows Subsystem for Linux (WSL) networking configuration and its active states are tracked within the Windows Registry (Regedit). While high-level networking modes (such as NAT, Mirrored, or Bridged) are defined in configuration files, the Windows operating system registers the active runtime states, network switches, and subsystem parameters across specific Registry keys under the HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE hives.

WSL Configuration Registry Keys

The Windows Subsystem for Linux manages its active distribution configurations, subsystem parameters, and network service attachments in the following Registry locations:

1. Distribution and User State Settings

• Path: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Lxss
• Purpose: This key contains globally registered WSL distributions, listed by their unique GUIDs (e.g., {GUID}). Each entry stores runtime flags, default user configurations, distribution base paths, and version information (WSL 1 vs. WSL 2).

2. The WSL Service Manager

• Path: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LxssManager
• Purpose: This location stores the service-level configuration for the LxssManager Windows service. It governs the startup parameters, security permissions, and operational behavior of the background service responsible for initializing WSL instances and handling system-level virtualization resources.

3. Virtual Switch and Host Network Service (HNS)

WSL 2 networking modes rely on Hyper-V virtual switches and the Host Network Service (HNS). The active virtual network adapters and switches assigned to WSL operate under: * Host Network Service State: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\hns\State * Virtual Switch Configuration: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vmswitch

When WSL initializes in NAT or Mirrored mode, the Windows Host Network Service dynamically provisions internal virtual adapters (such as the WSL virtual switch) and records the active network interfaces in these system service hives.

The Relationship Between .wslconfig and the Registry

Active networking modes (such as networkingMode=mirrored or networkingMode=NAT) are primarily declared in the global configuration file located at:

%USERPROFILE%\.wslconfig

The Windows Subsystem for Linux reads this file at startup and passes the instructions directly to the LxssManager service. The Registry stores the resulting system-level states, service endpoints, and virtual adapter registrations rather than exposing a direct manual switch for changing the networking mode setting itself.