Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. Windows
  3. System32
  4. drivers
  5. etc
FolderRisk: Caution

etc C:\Windows\System32\drivers\etc

C:\Windows\System32\drivers\etc: plain-text network files inherited from Unix: hosts (local resolution), services, protocol, networks and a sample lmhosts.sam.

Updated on By AltF4 Formation

What it’s for

drivers\etc holds the plain-text network configuration files that Windows inherited from Unix. Only one really matters to an administrator: hosts, which Windows reads before it queries DNS. The others are mostly directories of names and numbers, and the TCP/IP stack does not depend on them.

What it contains

  • hosts: host name to IP address mappings. Lines starting with # are comments, and the default file has no active entry.
  • services: service names and port numbers. protocol: IP protocol names and numbers. networks: network names. Each has its own page.
  • lmhosts.sam: a sample LMHOSTS file for NetBIOS name resolution.

Risks and best practices

  • hosts is the classic malware target, which redirects sites to malicious servers there. When network behavior looks odd, it is the first file to open.
  • To edit it, run an editor as administrator, keep a copy (hosts.bak) and comment lines out rather than deleting them. A stale entry causes connection errors that are hard to diagnose.
  • To go back to the original, save the default hosts file that Microsoft publishes, rename the current one to hosts.old, then copy the new one into the folder.

Useful commands

Fenêtre de terminal
# Files in the folder, with their modification date
Get-ChildItem "$env:windir\System32\drivers\etc" -Force | Select-Object Name, Length, LastWriteTime


# Active lines of the hosts file (excluding comments and blank lines)
Get-Content "$env:windir\System32\drivers\etc\hosts" | Where-Object { $_.Trim() -and $_ -notmatch '^\s*#' }


# Flush the DNS cache after changing hosts
ipconfig /flushdns

Folder contents

Files 5

Report a mistake