Where does Windows XP store wlan profiles and how to show/delete them?

Question

I'm running Windows XP on a computer I do not hold (full) admin rights to. I've been trying to figure out where to find and delete a specific wireless network profile using the command line.

Using netsh>wlan show profiles gives me an error message, stating this command (wlan) is not known. I've looked under the available options in netsh, but nothing there quite seems to match what I need.

I've tried net use as well, but that doesn't show the wireless network profile that I added earlier today that I am now trying to remove.

Checking out this site only mentions the 'netsh' option as far as I've seen.

Is net use the correct way of getting these network profiles and are my rights just too restricted for me to get this information, or is there another way of doing this within the command line?

Solution

The wireless network profiles are stored in the registry. Specifically, you'll want to look for this key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\{your-interface-GUID}

There, you'll find several values named Static#0000, Static#0001 and so on, one for every WLAN that particular interface on that system has ever been connected to. Of course, you can use cmd tools like REG QUERY or REG DELETE in order to show/delete them as you asked. Take into account, though, that the info is stored in REG_BINARY format, so depending on your exact needs you'll need a little bit of parsing.

More info on this (from page 13 on): http://www.sans.org/reading-room/whitepapers/forensics/wireless-networks-windows-registry-computer-been-33659