Winver plugin reports "Windows 10 Enterprise" for Windows 11 devices

[Bloggzy]

When processing the SOFTWARE registry hive, the winver plugin appears to extract the value of ProductName from:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion

I've seen instances of Windows 11 hosts having the ProductName recorded as "Windows 10 Enterprise" or "Windows 10 Pro".

This does not appear to be the fault of winver (as that is the value stored in the registry), but would it be possible to look at the CurrentBuild value (or similar) and add a warning if the build number is higher than 22,000? (Windows 10 builds appear to be between 10,000-20,000)

Windows 11 Versions / Builds / Release Dates

Version | Build | Release Date
21H2 | 22000 | October 4, 2021
22H2 | 22621 | September 20, 2022
23H2 | 22631 | October 31, 2023
24H2 | 26100 | H2 2024

[Karneades]

Any updates in between from your side?

would it be possible to look at the CurrentBuild value (or similar)

You could add that field to the values to look for: https://github.com/keydet89/RegRipper3.0/blob/master/plugins/winver.pl#L42 and then make a pull request to merge it into the tool after testing.

add a warning if the build number is higher than 22,000? (Windows 10 builds appear to be between 10,000-20,000)

The plugin currently extracts just values and information from the keys. What is the purpose of a warning? Would you like to find a mismatch between the values because of malicious behaviour? This is more of a Windows issue, than changing RegRipper to compensate the issue in my point of view.

[Bloggzy]

Yes, RegRipper extracts the data correctly, Windows is at fault for having incorrect data stored in the registry (i.e. saying Windows 10, when it’s actually Windows 11).

The warning would only be to assist users, and warn them of the potentially misleading data. I got caught out by it, and misreported the OS version to a client, so I’m sure it’s caught out others as well.

[Bloggzy]

Funnily enough this has come around again and I ended up looking at the winver plugin, came here to add an issue and found this existing one from 2 years ago 😂

I don't have the skill to do it / add it myself, but would we be able to modify the winver.pl to pull the following values?

(from: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion)

• CurrentBuild
• CurrentBuildNumber
• DisplayVersion

These appear to be good values that (at least in Windows 11) report the correct build number (as opposed to "BuildLab" and "BuildLabEx"). In my testing (running Windows 11 Build 26200 aka 25H2) the BuildLab and BuildLabEx reported 26100 values, but the CurrentBuild and CurrentBuildNumber returned 26200 (which is correct for 25H2).

I don't know if it would be as easy as modifying plugins/winver.pl to read:

 my %vals = (1 => "ProductName",
              2 => "ReleaseID",
              3 => "CSDVersion",
              4 => "BuildLab",
              5 => "BuildLabEx",
              6 => "CompositionEditionID",
              7 => "RegisteredOrganization",
              8 => "RegisteredOwner",
              9 => "CurrentBuild",
              10 => "CurrentBuildNumber",
              11 => "DisplayVersion");

[keydet89]

Thanks, I'll take a look. Sorry, I've been offline for a while, and I'm still digging out of my work inbox. ------------------------------------------ Harlan Carvey "Windows Forensic Analysis" http://windowsir.blogspot.com ------------------------------------------ On Wednesday, May 6, 2026 at 11:47:25 PM EDT, Bloggzy ***@***.***> wrote: Bloggzy left a comment (keydet89/RegRipper3.0#67) Funnily enough this has come around again and I ended up looking at the winver plugin, came here to add an issue and found this existing one from 2 years ago 😂 I don't have the skill to do it / add it myself, but would we be able to modify the winver.pl to pull the following values? (from: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion) - CurrentBuild - CurrentBuildNumber - DisplayVersion These appear to be good values that (at least in Windows 11) report the correct build number (as opposed to "BuildLab" and "BuildLabEx"). In my testing (running Windows 11 Build 26200 aka 25H2) the BuildLab and BuildLabEx reported 26100 values, but the CurrentBuild and CurrentBuildNumber returned 26200 (which is correct for 25H2). I don't know if it would be as easy as modifying plugins/winver.pl to read: my %vals = (1 => "ProductName", 2 => "ReleaseID", 3 => "CSDVersion", 4 => "BuildLab", 5 => "BuildLabEx", 6 => "CompositionEditionID", 7 => "RegisteredOrganization", 8 => "RegisteredOwner", 9 => "CurrentBuild", 10 => "CurrentBuildNumber", 11 => "DisplayVersion"); — Reply to this email directly, view it on GitHub, or unsubscribe. Triage notifications on the go with GitHub Mobile for iOS or Android. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>