Changing the MAC address in W2K and XP 

Method 1:

This is depending on the type of Network Interface Card (NIC) you have.  If you have a card that doesn’t support Clone MAC address, then you have to go to second method.

a. Go to Start->Settings->Control Panel and double click on Network and Dial-up Connections.

b. Right click on the NIC you want to change the MAC address and click on properties.

c. Under “General” tab, click on the “Configure” button

d. Click on “Advanced” tab

e. Under “Property section”, you should see an item called “Network Address” or "Locally Administered Address", click on it.

f. On the right side, under “Value”, type in the New MAC address you want to assign to your NIC.  Usually this value is entered without the “-“ between the MAC address numbers.

g. Goto command prompt and type in “ipconfig /all” or “net config rdr” to verify the changes.  If the changes are not materialized, then use the second method.

h. If successful, reboot your systems.

 

Method 2:

This method requires some knowledge on the Windows Registry.  If you are not familiar with Windows Registry, just use the SMAC tool to change the MAC addresses, or consult with a technical person before you attempt on the following steps.  Also, make sure you have a good backup of your registry.

a.     Goto command prompt and type “ipconfig /all”, and

    I. Record the Description for the NIC you want to change.

    II. Record the Physical Address for the NIC you want to change.  Physical Address is the MAC Address

figure 1.

b.     Goto command prompt and type “net config rdr”, and you should see something like

        figure 2.

c.     Remember the number between the long number (GUID) inside the { }.  For example, in the above “net config rdr” output, for MAC address “00C095ECB793,” you should remember {1C9324AD-ADB7-4920-B02D-AB281838637A}. You can copy and paste it to the Notepad, that’s probably the easiest way.  (See figure 2.)

d.     Go to Start -> Run, type “regedt32” to start registry editor.  Do not use “Regedit.”

e.     Do a BACKUP of your registry in case you screw up the following steps.  To do this

                                               I.     Click on “HKEY_LOCAL_MACHINE on Local Machine” sub-window

                                             II.     Click on the root key “HKEY_LOCAL_MACHINE”. 

                                           III.     Click on the drop-down menu “Registry -> Save Subtree As” and save the backup registry in to a file.  Keep this file in a safe place.

f.      Go to “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}.  Double click on it to expand the tree.  The subkeys are 4-digit numbers, which represent particular network adapters.  You should see it starts with 0000, then 0001, 0002, 0003 and so on.  (See figure 3.)

    Figure 3.

g.  Go through each subkey that starts with 0000.  Click on 0000, check DriverDesc keyword on the right to see if that's the NIC you want to change the MAC address.  The DriveDesc should match the Description you recorded from step (a.-I.).  If you are not 100% sure about the DriverDesc, then you can verify by checking if the NetCfgInstanceID keyword value matches the GUID from step (c).  If there is no match, then move on to 0001, 0002, 0003, and so on, until you find the one you want.  Usually 0000 contains the first NIC you installed on the computer.In this demonstration, 0000 is the NIC I selected. (See figure 3.)

h.  Once you selected the subkey (i.e. 0000), check if there is a keyword "NetworkAddress" exist in the right side of the window. (See figure 3.)

    I. If "NetworkAddress" keyword does not exist, then create this new keyword:

        i. Click on the drop down menu “Edit -> Add Value”.

        ii.  In the Add Value window, enter the following value then click OK.  (See figure 4.)             Value Name: = NetworkAddress            Data Type: = REG_SZ 

                              Figure 4.

        iii.  String Editor window will pop up at this time (see figure 5.)  

        iv.  Enter the new MAC address you want to modify.  Then click OK.        (There should not be any "-" in this address.  Your entry should only consist of 12 digits as seen in the figure 5.)

    II. If "NetworkAddress" keyword exists, make sure it shows the keyword type is REG_SZ, and it should show as NetworkAddress:REG_SZ:  .  This keyword might not have a value at this time.  

        i. Double click on the keyword NetworkAddress and the String Editor window will pop up. (See Figure 5.)

        ii.  Enter the new MAC address you want to modify.  Then click OK.        (There should not be any "-" in this address.  Your entry should only consist of 12 digits as seen in the figure 5.)

                    Figure 5.

j.      There are 2 ways to make the new MAC address active.  Method I does not require a system reboot:

    I.  Goto Start->Setting->Control Panel, and double click on "Network Neighborhood".    WARNING: Make sure you understand that you WILL lose the network connection after completing step "ii." below, and    if you have a DHCP client, you will get a new IP address after completing step "iii."

        i.  Select the Network Adaptor you just changed the MAC address.

        ii.  Right click on the selected Network Adaptor and click "Disable."         Verify the status column for this adaptor changes to "Disabled"

        iii.  Right click on the selected Network Adaptor and click "Enable."       Verify the status column for this adaptor changes to "Enabled"

        iv.  If for any reason it cannot be disabled or re-enabled, you have to        reboot your system to make the changes effective.

    II.  Reboot your Windows system. 

k.  Once completing step j (if rebooting the system, wait until the reboot is completed), go to command prompt, type “ipconfig /all” to confirm the new MAC address.

 

Restore The TRUE Hardware burned-in MAC Address:

a. Remove the entry you added:

I. If you followed Method 1, then go back to the advanced properties window and remove the entry you add.II. If you followed Method 2, then remove the "NetworkAddress" keyword you added in the registry.

b. Use step (j) above to activate the change you make.c. Once rebooted, go to command prompt, type “ipconfig /all” to confirm the original MAC address.

 

If MAC Address changes does not work:

If for whatever reason the MAC address cannot be changed using method 2, make sure you restore the registry setting by following the "Restore The TRUE Hardware burned-in MAC Address" instruction above.  If necessary, restore the registry you just backed-up to get your system back to the original state.  You can do this by clicking on the drop-down menu “Registry->Restore,” and restore your backup registry file.

How to Change a Computer's Mac Address in Windows

There might be a time when you want to change the MAC-address of your network adapter. The MAC-address (Media Access Control address)is a unique identifier which is used to identify your computer in a network. (e.g. an ip-address is assigned to your MAC-address)

Edit Steps1.1

Run the registry editor regedit (C:\windows\system32\regedit.exe)

2. 2

Go to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}

3. 3

Now find your adapter in the 4-digit list in this entry. You can use the DriverDesc entry to identify your adapter.

4. 4

Add a new string entry to your adapter entry called 'Networkaddress' (the one with 4 digits)

5. 5

Use a HEX MAC-address without -'s or :'s as a value for the entry, so if your MAC-address is 'DE:AD:BE:EF:CA:FE', you should enter DEADBEEFCAFE.

6. 6

Some adapters (especially WiFi cards) are unforgiving of MAC addresses changes if the first octet's 2nd half isn't a 2,6,A,E or begins with a zero. This requirement has been observed as far back as Windows XP and is formatted as:

7. 7

D2XXXXXXXXXX

8. 8

D6XXXXXXXXXX

9. 9

DAXXXXXXXXXX

10. 10

DEXXXXXXXXXX

11. 11

etc..

12. 12You can also disable and re-enable your adapter within Windows for the change to become effective without rebooting. Just sliding the WiFi's On/Off switch like the slider found on ThinkPad's and VaiO's won't satisfactorily disable/re-enable the card.

Add method

Edit Tips You can also have funny MAC-addresses names because hexadecimal numbers use the letters A-F

Edit Warnings Don't use a MAC-address which is already in use, as this will prevent one of the machines from connecting to the network.

How to Change or Spoof MAC Address in Windows XP, Vista, Server 2003/2008, Mac OS X, Unix and LinuxMAC address (Media Access Control address) is a quasi-unique identifier consists of a six byte number that attached to most network adapter card or network interface card (NIC). As such, all network cards, whether it’s of Ethernet NIC, Gigabit Ethernet NIC or wireless 802.11a/b/g/n WiFi or HiperLAN adapter, should have different MAC addresses, which also known as Ethernet Hardware Address (EHA) or adapter address.

In operating system, MAC address is often represented in 12-digit hexadecimal number. For example, 1A-2B-3C-4D-5E-6F. In practical usage, layer 2 MAC address is converted from layer 3 protocol addresses such as Internet Protocol (IP address) by ARP (Address Resolution Protocol), which then allowed each host to be uniquely identified and frames to be marked for specific hosts on broadcast networks, such as Ethernet. After translated (or when a host on LAN sends its MAC address to another machine which does n ot configured not to accept unrequested ARP replies on the network for preemptive caching), MAC address is cached on source PC ARP table for later use. Content of ARP table on each computer can be viewed by typing arp -a in Windows or arp in Linux. MAC address thus forms the basis of most of the layer 2 networking upon which higher OSI Layer protocols are built to produce complex, functioning networks.

There are many reasons or possibilities that an user may want to change the MAC address or a network adapter, which also known as MAC spoofing. For example, to bypass the MAC address filtering on firewall or router. The trick can be used to get pass the network access restriction by emulating a new unrestricted MAC address, or to gain access connection by spoof an authorized MAC address after sniffing the legitimate MAC address out of the air in MAC filtering Wi-Fi network.

Beside, hackers or enthusiasts also spoofing another host’s MAC address as their own in order to receive traffic packets not meant for them, although ARP poisoning technique is more commonly used. However, changing MAC address can still keep the real information from been detected and logged by various services such as IDS, firewall, DHCP server, wireless access points and etc, and is essential protect user’s privacy. MAC spoofing also potentially trigger a Denial of Service (DoS) attack by causing routing problem with duplicating MAC address exists in the network, especially those similar with gateway and AP router’s BSSID (Basic Service Set Identifier.)

Whatever the reason, it’s pretty easy to change the MAC address or perform MAC spoofing on most of today’s hardware, listed below. Actually, the original MAC address is burnt and imprinted to the network card, and cannot be changed. However, operating system can spoof as if there is different MAC address for the network interface card using tricks below.

Change the MAC address in Windows1. Go to Start -> Control Panel. Double click on Network Connections (inside Network and Internet Connections category in Windows XP). The, right click on the active network connection with network adapter that you

want to change the MAC address (normally Local Area Network or Wireless Network Connection) and click on Properties.Above steps work in Windows XP, Windows 2000 and Windows Server 2003. For Windows Vista, access to NIC’s properties is from Control Panel -> Network and Internet -> Network and Sharing Center -> Manage Network Connections.Alternatively, if you already know which network adapter that’s responsible for your network or Internet connection, go to Device Manager and open the properties dialog by double click on the NIC itself.

2. In the General tab, click on the Configure button.3. Click on Advanced tab.4. In the Property section, select and highlight Network Address or Locally Administered Address.5. To the right, “Not Present” radio button is by default selected as value. Change the value by clicking on radio button for Value:, and then type in a new MAC address to assign to the NIC.

The MAC address consists of 6 pairs of numbers (0 – 9) and characters (A – F) combination. For example, 88-17-E8-90-E2-0A. When entering the new MAC value, omit the dash (-), for example 8817E890E20A.

6. Click OK when done.7. To verify the change of MAC address, go to command prompt, then type in one of the following commands:

ipconfig /allnet config rdr

8. Reboot the computer if successful to make the change effective.

Note: To restore or reset back to original default MAC address, simply set back the option to “Not Present”.

Change the MAC Address of NIC in Windows via Registry1. Open a command prompt.2. Type the following command and hit Enter.

ipconfig /all

3. Record down the Description and the Physical Address (is MAC address) of the active network connection (discard those with Media Disconnected state).

For example, in figure above, Description is Intel(R) Wireless WiFi Link 4965AGN and MAC address is in the format of 00-XX-XX-XX-XX-XX.

4. In the command prompt also, type the following command and hit Enter.net config rdr

5. Record down the GUID for the MAC address for the active connection’s NIC which MAC address to be changed. The GUID is contained within the { and } brackets right in front of the MAC address as shown in figure below.

6. Type regedt32 or regedit in Start -> Run box or in Start Search for Windows Vista. Note: for Windows NT 4.0 and Windows 2000, regedt32 must be used.7. Navigate to the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}8. Expand the {4D36E972-E325-11CE-BFC1-08002BE10318} tree, and there will be more sub-keys in the form of 0000, 0001, 0002 and so on.9. Go through each sub-key starting from 0000, look for subkey that has DriverDesc value data that matches NIC description copied from step above, that want its MAC address to be changed. In most cases, it will be similar to the

network adapter card name.To verify that the subkey found is indeed a correct one, check the value of the NetCfgInstanceId, which should have the same value with the NIC’s GUID taken from step above.

10. Once a sub-key is matched to the network interface card that MAC address want to be spoofed, select and highlight the subkey. Right click on the sub-key (for example, 0000), then select New ->String Value. Name the new value name as NetworkAddress.

Note: If NetworkAddress REG_SZ registry key is already existed in the right pane, skip this step.

11. The double click on NetworkAddress and enter a new MAC address as its value data.

Note that the 12-digit MAC address in hexadecimal format, and should be entered without any dash (-). For example, 1A2B3C4D5E6F.

12. Reboot the system to make the new MAC address effective. Alternatively, if you don’t want to restart the system, try to disable and then re-enable the network adapter in Device Manager.13. To verify the change of MAC address, go to command prompt, then type in one of the following commands:

ipconfig /allnet config rdr

Note: To restore or reset back to true original hardware burned-in MAC address, remove the NetworkAddress registry key that is been added.

Alternative: Third party tools and utilities to change the MAC address in Windows operating system are plenty, for example: SMAC (direct download link to smac20_setup.ex, supports Windows Vista, XP, 2003, 2000), Macshift (direct download link to macshift.zip, for Windows XP), BMAC (almost identical SMAC MAC changer clone by moorer-software.com), Mac MakeUp (direct download link tomacmakeup.zip, for Windows 2000/XP/2003/Vista),