Home | @busar | FAQ | Notícias | Processos | Imprimir | CADASTRO | ATUALIZAÇÃO | PAGAMENTO | IP .229
Como se inscrever
Atualizar Cadastro
Teste de LOG OFF
Perguntas freqüentes
Links recomendados

Dados Internet Brasil 
Material de imprensa
Notícias: News Fórum
Notícias publicadas
Termos/Cond. de Uso
Linha do Tempo

Regulamentação Anatel
Consulta Pública 417

Modems - Configuração
Hardware Cabos
Linux: dicas de uso
Redes privadas VPN
Softwares (download)

FTP Abusar Pitanga

TV Digital
Vesper Giro

Serviços ModemClub

SpeedStat - Teste sua conexão
Mostra IP
- Descubra seu IP e Host Name
Suporte ModemClub

Fórum Banda Larga

Clube das Redes
Clube do Hardware
Guia do Hardware
Fórum GDH
Fórum PCs
InfoHELP - Fórum
Portal ADSL - Fórum
- Fórum
Tele 171

Fale com a ABUSAR Material de imprensa
Copyleft © 2002 ABUSAR.org
Termos e Condições de Uso

Speakeasy Speed Test


Change MAC Addresses on Windows 2000 & XP
Link Original: www.klcconsulting.net/Change_MAC_w2k.htm

NEWS! SMAC 1.1 now supports Windows 2003 Servers!

NEWS! WebDAV Vulnerability and Fixes (MS03-007)

NEWS! DeLoder worm/Trojan Analysis

NEWS! SMAC 1.1 is released! It is a MAC Address Modifying Utility for Windows 2000, XP and 2003 Server in all languages.



KLC Consulting, Inc.

Last Update: 5/29/2003

Original Release: 11/19/ 2002

  • Test Security Vulnerability on MAC Address based Authentication and Authorization Systems

  • Build "TRUE" Stand-by (offline) systems with the EXACT same CompterName, IP, and MAC ADDRESSES as the Primary Systems.  If Stand-by systems should be put online, NO arp table refresh is necessary, which eliminates extra downtime.

  • Build High-Availability solutions

  • Troubleshoot Network problems.  Arp Tables, Routering, Switching, ...

  • Troubleshoot system problems

  • Test network management tools

  • Test incident response procedures on simulated network problems

  • Test Intrusion Detection Systems (IDS), whether they are Host and Network Based IDS.

  • Some software can ONLY be installed and run on the systems with pre-defined MAC address in the license file.  If you need to install one of these applications to another system with a different NIC, SMAC will come handy.  Make sure you comply with the vendor's licensing agreement.

  • If for whatever reason you need to keep the same MAC address as your old NIC, but your old NIC failed...

  • Some Cable Modem ISP's assign IP addresses base on the PC's MAC addresses.  For whatever reason, if you need to swap 2 PC's  regularly to connect to the cable modem, it would be a lot easier to change the MAC addresses rather than to change Network Interface Card (NIC).  (Of course a cable modem router like Linksys or Netgear would be even easier for this job, and many cable modem routers have a "Clone MAC Address" feature built-in for this purpose.)  Check with your ISP and make sure you are not violating any service agreements.

  • SMAC took advantage of the NdisReadNetworkAddress function in the Microsoft Device Driver Development Kit (DDK.)

  • NdisReadNetworkAddress(...) is called by the network adapter driver to obtain a user specified MAC address in the registry. After the driver confirms that there's a valid MAC address specified in the registry key, the driver then programs the MAC address to its hardware registers to override the burn-in MAC address.

  • Make sure you DO NOT assign one MAC address to multiple NIC's on a local area network (LAN).  If you do that, you will create a lot of problems.  MAKE SURE YOU HAVE ONE UNIQUE MAC ADDRESS PER NIC!!!

  • Make sure you DO NOT use Multicast MAC addresses.  You can check out the Multicast MAC addresses at http://www.iana.org/assignments/ethernet-numbers.


  • SMAC is a Windows MAC Address Modifying tool, and is based on this research article.  SMAC is developed by KLC Consulting Security Team.  URL of SMAC is http://www.klcconsulting.net/smac

There could be couple ways to do this.  Make sure you read through the steps first.  If my explanation does not make sense to you, it’s probably my writing.  Please send me an email.  However, if you want to follow the steps below, you probably want to make sure you are technically comfortable before you start.  If you are not technically comfortable, you can use KLC's GUI-based MAC Address Modifying Utility, SMAC, to simply change MAC addresses on Windows 2000, XP, and 2003 Servers.  The following information is provided “AS IS.”  If you have any inputs, please send me an email.

*** Disclaimer: Try these steps at your own risk!!!  These steps will work, but they are not supported by Microsoft.  
*** I will not be responsible for any damages that might occur on your system.
*** Please don't try the steps below if you do not agree with this disclaimer!

Before we start:  KLC Consulting Security Team has developed a Windows MAC Address Modifying tool, SMAC.  SMAC is developed based on this research article, and it has many functionalities.  SMAC allows Windows 2000, XP, and 2003 Server users to change MAC address regardless of whether manufacturers allow this option or not.  URL of SMAC is http://www.klcconsulting.net/smac

Method 1:

This is depending on the type of Network Interface Card (NIC) you have.  If you have a card that doesn’t support Clone MAC address, then you have to go to second method.

  1. Go to Start->Settings->Control Panel and double click on Network and Dial-up Connections.

  2. Right click on the NIC you want to change the MAC address and click on properties.

  3. Under “General” tab, click on the “Configure” button

  4. Click on “Advanced” tab

  5. Under “Property section”, you should see an item called “Network Address” or "Locally Administered Address", click on it.

  6. On the right side, under “Value”, type in the New MAC address you want to assign to your NIC.  Usually this value is entered without the “-“ between the MAC address numbers.

  7. Goto command prompt and type in “ipconfig /all” or “net config rdr” to verify the changes.  If the changes are not materialized, then use the second method.

  8. If successful, reboot your systems.

Method 2:

This method requires some knowledge on the Windows Registry.  If you are not familiar with Windows Registry, just use the SMAC tool to change the MAC addresses, or consult with a technical person before you attempt on the following steps.  Also, make sure you have a good backup of your registry.

a.     Goto command prompt and type “ipconfig /all”, and

    I. Record the Description for the NIC you want to change.

    II. Record the Physical Address for the NIC you want to change.  Physical Address is the MAC Address

figure 1.

b.     Goto command prompt and type “net config rdr”, and you should see something like

figure 2.

c.     Remember the number between the long number (GUID) inside the { }.  For example, in the above “net config rdr” output, for MAC address “00C095ECB793,” you should remember {1C9324AD-ADB7-4920-B02D-AB281838637A}.  You can copy and paste it to the Notepad, that’s probably the easiest way.  (See figure 2.)

d.     Go to Start -> Run, type “regedt32” to start registry editor.  Do not use “Regedit.”

e.     Do a BACKUP of your registry in case you screw up the following steps.  To do this

                                               I.     Click on “HKEY_LOCAL_MACHINE on Local Machine” sub-window

                                             II.     Click on the root key “HKEY_LOCAL_MACHINE”. 

                                           III.     Click on the drop-down menu “Registry -> Save Subtree As” and save the backup registry in to a file.  Keep this file in a safe place.

f.      Go to “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}.  Double click on it to expand the tree.  The subkeys are 4-digit numbers, which represent particular network adapters.  You should see it starts with 0000, then 0001, 0002, 0003 and so on.  (See figure 3.)

Figure 3.

g.  Go through each subkey that starts with 0000.  Click on 0000, check DriverDesc keyword on the right to see if that's the NIC you want to change the MAC address.  The DriveDesc should match the Description you recorded from step (a.-I.).  If you are not 100% sure about the DriverDesc, then you can verify by checking if the NetCfgInstanceID keyword value matches the GUID from step (c).  
If there is no match, then move on to 0001, 0002, 0003, and so on, until you find the one you want.  Usually 0000 contains the first NIC you installed on the computer.
In this demonstration, 0000 is the NIC I selected. (See figure 3.)

h.  Once you selected the subkey (i.e. 0000), check if there is a keyword "NetworkAddress" exist in the right side of the window. (See figure 3.)

    I. If "NetworkAddress" keyword does not exist, then create this new keyword:

        i. Click on the drop down menu “Edit -> Add Value”.

        ii.  In the Add Value window, enter the following value then click OK.  (See figure 4.) 
            Value Name: = NetworkAddress
         Data Type: = REG_SZ 

            Figure 4.

        iii.  String Editor window will pop up at this time (see figure 5.)  

        iv.  Enter the new MAC address you want to modify.  Then click OK.
        (There should not be any "-" in this address.  Your entry should only consist of 12 digits as seen in the figure 5.)

    II. If "NetworkAddress" keyword exists, make sure it shows the keyword type is REG_SZ, and it should show as NetworkAddress:REG_SZ:  .  This keyword might not have a value at this time.  

        i. Double click on the keyword NetworkAddress and the String Editor window will pop up. (See Figure 5.)

        ii.  Enter the new MAC address you want to modify.  Then click OK.
        (There should not be any "-" in this address.  Your entry should only consist of 12 digits as seen in the figure 5.)

        Figure 5.

j.      There are 2 ways to make the new MAC address active.  Method I does not require a system reboot:

    I.  Goto Start->Setting->Control Panel, and double click on "Network Neighborhood".
    WARNING: Make sure you understand that you WILL lose the network connection after completing step "ii." below, and
    if you have a DHCP client, you will get a new IP address after completing step "iii."

        i.  Select the Network Adaptor you just changed the MAC address.

        ii.  Right click on the selected Network Adaptor and click "Disable."  
       Verify the status column for this adaptor changes to "Disabled"

        iii.  Right click on the selected Network Adaptor and click "Enable."
       Verify the status column for this adaptor changes to "Enabled"

        iv.  If for any reason it cannot be disabled or re-enabled, you have to
        reboot your system to make the changes effective.

    II.  Reboot your Windows system. 

k.  Once completing step j (if rebooting the system, wait until the reboot is completed), go to command prompt, type “ipconfig /all” to confirm the new MAC address.

Restore The TRUE Hardware burned-in MAC Address:

  1. Remove the entry you added:

  1. If you followed Method 1, then go back to the advanced properties window and remove the entry you add.

  2. If you followed Method 2, then remove the "NetworkAddress" keyword you added in the registry.

  1. Use step (j) above to activate the change you make.

  2. Once rebooted, go to command prompt, type “ipconfig /all” to confirm the original MAC address.

If MAC Address changes does not work:

If for whatever reason the MAC address cannot be changed using method 2, make sure you restore the registry setting by following the "Restore The TRUE Hardware burned-in MAC Address" instruction above.  If necessary, restore the registry you just backed-up to get your system back to the original state.  You can do this by clicking on the drop-down menu “Registry->Restore,” and restore your backup registry file.

MAC Address Modifying Utility:

KLC Consulting Security Team has developed SMAC, a Windows MAC Address Modifying Utility for Windows 2000, XP and 2003 Server systems, regardless of whether manufacturers allow this option or not.  URL of SMAC is http://www.klcconsulting.net/smac


  1. Microsoft MSDN - Network Devices and Protocols: Windows DDK - NdisReadNetworkAddress function.

  2. Microsoft Windows 2000 Resource Kit - (Network adapters) {4D36E972-E325-11CE-BFC1-08002BE10318}

  3. Microsoft MSDN - Security Issues for Network Drivers

Additional information:

  1. MAC Address Spoofing for Windows 2000, XP, and 2003 Server systems

  2. MAC Address Spoofing for Windows NT 4.0

  3. MAC Address Spoofing for Windows 98

  4. MAC Address Spoofing for Unix/Linux

  5. Trojan Analysis by Kyle Lai

Você pode ser colaborador da ABUSAR
Envie seu artigo, que estudaremos sua publicação, com os devidos créditos !


abusarXspeedy.jpg (29296 bytes)

Compartilhe a Internet
usando FreeBSD + Squid
Daniel de Melo Gonçalves


Compartilhamento de Conexão

Limite de Download

Mudança de Endereço mantendo o Speedy Antigo

Cancelando o Speedy

Comparação entre Serviços de Banda Larga

Qual a melhor tecnologia da banda larga?

Como saber se seu Speedy é ATM, Megavia, PPPOE ou Capado (NovoSpeedy)  

Guia para reduzir gastos Telefônicos

Economizando Megabytes em sua Banda Larga

"Evolução" dos Pop-ups do Speedy


Uso seguro da Internet

Acesso a bancos
Uma ótima dica, simples mas muito interssante...

Cartilha de Segurança para Internet
Comitê Gestor da Internet

Mantenha o Windows atualizado (e mais seguro) !

Dicas de como comprar
com segurança na internet

Site Internet Segura

Dicas para navegação segura na Web

Proteja seu Micro

Proteja seu PC
Microsoft Security

- Processo - Réplica - Quesitos - Decisão

Quer pôr fotos na Web e não sabe como?

Tem coisas que só a telecômica faz por você !