0

Is it possible to determine which, if any, Windows versions were previously installed on a machine?

Use case example: I'd like to find out if Windows 2012/2016 images we use were in-place upgrades or to be able to show that a machine has not been a fresh install since whatever version.

I've done some poking around within the registry, wmic, etc. but can't find any remnants that point to previously installed Windows versions.

TryTryAgain
  • 217
  • 3
  • 13
  • Look at old images of the HDD, since Restore Points and Registry can be changed or deleted. – DrMoishe Pippik Sep 12 '19 at 15:09
  • @DrMoishePippik not sure I follow what you mean. Our "images" are deployed to VMware infrastructure, images are not stored within the OS. – TryTryAgain Sep 12 '19 at 15:24
  • HDD images, backed up to other media, e.g. tape or another HDD – DrMoishe Pippik Sep 12 '19 at 15:30
  • If you performed an in-placed upgrade from a previous version to the current version of Windows, after the grace period for the upgrade has past, there is little to no evidence the upgrade happend. **There is no difference between an in-place upgrade to Windows Server 2016 and a clean install of Window Sever 2016 other than you have the option of keeping your data.** – Ramhound Sep 12 '19 at 15:55
  • 1
    Possible duplicate of [How do I tell if Windows 10 was a fresh install or upgrade from 7/8?](https://superuser.com/questions/1032064/how-do-i-tell-if-windows-10-was-a-fresh-install-or-upgrade-from-7-8). You can either boot the VM and look at the key, or mount the `HKEY_LOCAL_MACHINE` hive file within your host OS, and look at the key that way. This key will be present for all versions upgrade to operating systems based on Windows 10. – Ramhound Sep 12 '19 at 15:57
  • @Ramhound thanks for pointing out the duplicate, didn't show up in my searches. I think that's pretty much exactly what I was looking for and consider that a solution to the ask. – TryTryAgain Sep 12 '19 at 16:08

0 Answers0