cheat sheet

getmac

Display the MAC (hardware) addresses and associated transport names for all network adapters on a local or remote Windows machine — useful for asset inventory, DHCP reservation setup, and network access control.

updated 05-26-2026

getmac — MAC Address Query

What it is

getmac is a built-in Windows command that reports the MAC (Media Access Control) address — the hardware-level Layer 2 identifier — for every network adapter installed on the local machine or on a remote host. It presents addresses in the AA-BB-CC-DD-EE-FF hyphenated format alongside the connection name and transport. Use it for DHCP reservation entries, 802.1X NAC policies, network asset inventories, or simply to confirm which physical adapter maps to which logical interface name. The PowerShell equivalent is Get-NetAdapter | Select-Object Name,MacAddress.

Availability

getmac ships as C:\Windows\System32\getmac.exe on Windows XP and later.

cmd

getmac /?

Output:

perl

GETMAC [/S system [/U username [/P [password]]]] [/FO format] [/NH] [/V]

Description:
    This tool enables an administrator to display the MAC address
    for network adapters on a system.

Parameter List:
    /S      system          Specifies the remote system to connect to.
    /U      [domain\]user   Specifies the user context under which
                            the command should execute.
    /P      [password]      Specifies the password for the given
                            user context.
    /FO     format          Specifies the format in which the output
                            is to be displayed.
                            Valid values: "TABLE", "LIST", "CSV"
    /NH                     Specifies that the "Column Header" should
                            not be displayed in the output.
    /V                      Specifies that the verbose output is displayed.

Syntax

cmd

getmac [/S system [/U domain\user [/P password]]] [/FO TABLE|LIST|CSV] [/NH] [/V]

Output: (table of adapters and MAC addresses)

Essential options

Switch	Meaning
`/FO TABLE`	Tabular output (default)
`/FO LIST`	Vertical list — one property per line, easier to parse in scripts
`/FO CSV`	Comma-separated values — pipe into Excel or a log file
`/NH`	No header row (useful when processing output in a script)
`/V`	Verbose — adds Connection Name and Network Adapter columns
`/S <host>`	Query a remote machine
`/U domain\user`	Run under a different credential for remote queries
`/P <password>`	Password for `/U`

Basic usage

Running getmac with no arguments shows MAC addresses for all enabled adapters on the local machine.

cmd

getmac

Output:

ini

Physical Address    Transport Name
=================== ==========================================================
00-1A-2B-3C-4D-5E   \Device\Tcpip_{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}

Verbose output

/V adds the human-readable connection name and adapter description, making it easy to correlate MAC addresses with the names visible in Network Connections.

cmd

getmac /V

Output:

scss

Connection Name          Network Adapter                  Physical Address    Transport Name
======================== ================================ =================== =====================================
Ethernet                 Intel(R) Ethernet Connection     00-1A-2B-3C-4D-5E   \Device\Tcpip_{A1B2C3D4-...}
Wi-Fi                    Intel(R) Wi-Fi 6 AX201           A0-B1-C2-D3-E4-F5   \Device\Tcpip_{B2C3D4E5-...}

CSV output for scripting

/FO CSV /NH produces clean comma-separated output without the header row — pipe it into findstr, redirect to a file, or process with PowerShell for asset inventory automation.

cmd

getmac /FO CSV /NH

Output:

arduino

"00-1A-2B-3C-4D-5E","\Device\Tcpip_{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}"
"A0-B1-C2-D3-E4-F5","\Device\Tcpip_{B2C3D4E5-F6A7-8901-BCDE-F12345678901}"

List output for readable display

/FO LIST presents each adapter as a block of key:value pairs — easier for humans to read than a wide table row.

cmd

getmac /FO LIST /V

Output:

yaml

Host Name:                 MYHOST
Physical Address:          00-1A-2B-3C-4D-5E
Transport Name:            \Device\Tcpip_{A1B2C3D4-E5F6-7890-ABCD-EF1234567890}
Connection Name:           Ethernet
Network Adapter:           Intel(R) Ethernet Connection

Host Name:                 MYHOST
Physical Address:          A0-B1-C2-D3-E4-F5
Transport Name:            \Device\Tcpip_{B2C3D4E5-F6A7-8901-BCDE-F12345678901}
Connection Name:           Wi-Fi
Network Adapter:           Intel(R) Wi-Fi 6 AX201

Querying a remote machine

/S connects to a remote host. Requires appropriate network access and admin credentials for the remote machine.

cmd

getmac /S fileserver01 /U CORP\alicedev /V

Output:

ini

Connection Name          Network Adapter                  Physical Address    Transport Name
======================== ================================ =================== =====================================
Ethernet 0               Broadcom NetXtreme Gigabit       00-50-56-AB-CD-EF   \Device\Tcpip_{C3D4E5F6-...}

PowerShell equivalents

PowerShell's Get-NetAdapter cmdlet (Windows 8+/Server 2012+) is the modern replacement for getmac. It returns rich objects you can filter, sort, and join with other data sources rather than text lines you have to parse.

Get-NetAdapter returns one object per adapter with Name, InterfaceDescription, Status, MacAddress, LinkSpeed, and the underlying ifIndex.

powershell

Get-NetAdapter | Format-Table Name, InterfaceDescription, Status, MacAddress, LinkSpeed -AutoSize

Output:

scss

Name        InterfaceDescription              Status      MacAddress         LinkSpeed
----        --------------------              ------      ----------         ---------
Ethernet    Intel(R) Ethernet Connection      Up          00-1A-2B-3C-4D-5E  1 Gbps
Wi-Fi       Intel(R) Wi-Fi 6 AX201            Up          A0-B1-C2-D3-E4-F5  866.7 Mbps
vEthernet   Hyper-V Virtual Ethernet Adapter  Up          00-15-5D-01-02-03  10 Gbps

Filter to only physical, up-state NICs (skips Hyper-V, VPN, loopback):

powershell

Get-NetAdapter -Physical | Where-Object Status -eq 'Up' |
    Select-Object Name, MacAddress, LinkSpeed

Output:

arduino

Name      MacAddress          LinkSpeed
----      ----------          ---------
Ethernet  00-1A-2B-3C-4D-5E   1 Gbps
Wi-Fi     A0-B1-C2-D3-E4-F5   866.7 Mbps

Get the MAC of just one adapter by name (note Get-NetAdapter matches the Name column, not InterfaceDescription):

powershell

(Get-NetAdapter -Name 'Ethernet').MacAddress

Output:

code

00-1A-2B-3C-4D-5E

Cross-reference with Get-NetIPConfiguration to see MAC + IP + DNS in one view:

powershell

Get-NetIPConfiguration -InterfaceAlias 'Ethernet' |
    Select-Object InterfaceAlias,
                  @{N='MAC';E={(Get-NetAdapter -Name $_.InterfaceAlias).MacAddress}},
                  IPv4Address,
                  IPv4DefaultGateway

Output:

yaml

InterfaceAlias    : Ethernet
MAC               : 00-1A-2B-3C-4D-5E
IPv4Address       : {192.168.1.100}
IPv4DefaultGateway: {192.168.1.1}

MAC address formatting and normalization

Tools and vendors disagree on MAC formatting. DHCP servers want 00:1a:2b:3c:4d:5e (colons, lowercase), Windows displays 00-1A-2B-3C-4D-5E (hyphens, uppercase), Cisco shows 001a.2b3c.4d5e (dot-quads). Convert in PowerShell.

powershell

$mac = (Get-NetAdapter -Name 'Ethernet').MacAddress  # 00-1A-2B-3C-4D-5E

# To colon-separated lowercase (DHCP, Linux)
$mac.Replace('-', ':').ToLower()

# To dot-quad (Cisco IOS)
($mac -replace '-', '') -replace '(.{4})', '$1.' -replace '\.$',''

# Raw 12-char hex
$mac -replace '-', ''

Output:

makefile

00:1a:2b:3c:4d:5e
001A.2B3C.4D5E
001A2B3C4D5E

OUI lookup and vendor identification

The first three bytes (Organizationally Unique Identifier) identify the hardware vendor. Common OUIs are worth recognizing at a glance.

OUI prefix	Vendor
`00-15-5D`	Microsoft Hyper-V virtual NIC
`00-50-56`	VMware virtual NIC
`08-00-27`	VirtualBox virtual NIC
`52-54-00`	KVM / QEMU virtual NIC
`00-0C-29`	VMware ESXi
`00-1C-42`	Parallels virtual NIC
`00-03-FF`	Microsoft Network Load Balancer cluster
`02-XX-XX`	Locally administered (random MAC)

If a MAC starts with 00-15-5D you're looking at a Hyper-V vNIC, not a physical adapter — useful for filtering inventory.

powershell

Get-NetAdapter |
    Where-Object { $_.MacAddress -like '00-15-5D-*' } |
    Select-Object Name, MacAddress, InterfaceDescription

Output:

arduino

Name          MacAddress         InterfaceDescription
----          ----------         --------------------
vEthernet1    00-15-5D-01-02-03  Hyper-V Virtual Ethernet Adapter
vEthernet2    00-15-5D-01-02-04  Hyper-V Virtual Ethernet Adapter

Changing the MAC (driver override)

Many wired NICs and most wireless chipsets support a software-defined "locally administered" MAC via the adapter's advanced properties. Set it with Set-NetAdapterAdvancedProperty and the NetworkAddress keyword.

powershell

# Set a locally-administered MAC (note 2nd hex char must be 2, 6, A, or E)
Set-NetAdapterAdvancedProperty -Name 'Ethernet' `
    -RegistryKeyword 'NetworkAddress' `
    -RegistryValue '021A2B3C4D5E'

# Reset to factory burned-in MAC
Reset-NetAdapterAdvancedProperty -Name 'Ethernet' -DisplayName 'Network Address'

Output:

csharp

(none — exits 0 on success)

After setting, disable + enable the adapter (Disable-NetAdapter / Enable-NetAdapter) for the change to take effect.

Common pitfalls

Disconnected adapters show N/A — adapters that are disabled or media-disconnected may appear with Media disconnected or be omitted; enable the adapter to see its MAC.
Virtual adapters inflate the list — VPN clients, Hyper-V virtual switches, and loopback adapters all show up; use /V and filter by Connection Name to find physical NICs.
Remote query requires File and Printer Sharing — /S uses WMI/RPC; ensure the target's firewall allows these; alternatively use PowerShell Invoke-Command with Get-NetAdapter.
Password in plaintext with /P — avoid scripting /P password in batch files; prefer Windows Credential Manager or a scheduled task with a stored credential.
MAC addresses can be spoofed — getmac reports the MAC the driver presents to the OS; software-defined adapters and some Wi-Fi chipsets support MAC randomization, so the reported MAC may not match the burned-in hardware address.
MAC randomization on Wi-Fi — Windows 10+ supports per-SSID random MACs (Settings → Wi-Fi → Manage known networks → Random hardware addresses). getmac reports the per-SSID random MAC, not the burned-in one.
TPM-bound NIC firmware — some enterprise NICs (Intel vPro, certain Broadcom server NICs) refuse Set-NetAdapterAdvancedProperty NetworkAddress for security reasons; getmac will always return the firmware MAC.
/S over the internet is blocked — RPC port 135 + dynamic high ports are usually firewalled off internet-facing machines; use WinRM-based PowerShell remoting (Invoke-Command) instead.
Windows 11 24H2 random Wi-Fi MAC rotates daily — the per-SSID random hardware address now rolls every 24 hours by default unless the SSID is marked "Connect automatically"; getmac shows whichever MAC is currently in use, so back-to-back queries can differ. Disable rotation in Settings → Network & internet → Wi-Fi → <SSID> → Random hardware addresses → Off to pin one MAC for DHCP reservations.
getmac is not deprecated but is no longer updated — Microsoft's stance (as of the 2026-05 deprecated-features list) is that getmac.exe remains supported for back-compat but receives no new switches; treat it as a legacy reporting tool and prefer Get-NetAdapter for any scripting work.

Real-world recipes

Extract just the MAC address for the Ethernet adapter

cmd

getmac /FO LIST /V | findstr /I "Physical\|Ethernet"

Output:

yaml

Connection Name:           Ethernet
Physical Address:          00-1A-2B-3C-4D-5E

Build a MAC inventory from multiple machines

cmd

@echo off
for %%H in (server01 server02 workstation01) do (
    echo %%H:
    getmac /S %%H /FO CSV /NH /V 2>NUL
    echo.
)

Output:

makefile

server01:
"Ethernet","Intel Ethernet","00-50-56-AB-CD-EF","\Device\Tcpip_{...}"

server02:
"Ethernet","Broadcom NetXtreme","00-1A-4B-8C-2D-7E","\Device\Tcpip_{...}"

workstation01:
"Ethernet","Realtek PCIe GbE","D4-E8-53-A1-22-B9","\Device\Tcpip_{...}"

Grab the local MAC for a DHCP reservation script

cmd

for /f "tokens=1 delims=," %M in ('getmac /FO CSV /NH') do echo %~M

Output:

code

00-1A-2B-3C-4D-5E

Build a network inventory CSV across an OU with PowerShell

Get-ADComputer enumerates an Active Directory organizational unit; Invoke-Command runs Get-NetAdapter against each. Far cleaner than scripting getmac /S in a for loop.

powershell

$ou = 'OU=Workstations,DC=corp,DC=example,DC=com'
$hosts = (Get-ADComputer -SearchBase $ou -Filter *).Name

Invoke-Command -ComputerName $hosts -ScriptBlock {
    Get-NetAdapter -Physical | Where-Object Status -eq 'Up' |
        Select-Object @{N='Host';E={$env:COMPUTERNAME}},
                      Name, MacAddress, LinkSpeed
} -ErrorAction SilentlyContinue |
    Export-Csv -Path C:\Audit\mac-inventory.csv -NoTypeInformation

Output:

css

(none — CSV written to C:\Audit\mac-inventory.csv)

Generate DHCP reservation YAML from local MACs

The Get-NetAdapter object plus Get-NetIPAddress gives you everything a DHCP reservation needs: MAC, current IP, hostname.

powershell

$nic = Get-NetAdapter -Physical | Where-Object Status -eq 'Up' | Select-Object -First 1
$ip  = (Get-NetIPAddress -InterfaceIndex $nic.ifIndex -AddressFamily IPv4).IPAddress
@"
reservation:
  host: $env:COMPUTERNAME
  mac:  $($nic.MacAddress.Replace('-',':').ToLower())
  ip:   $ip
"@

Output:

yaml

reservation:
  host: MYHOST
  mac:  00:1a:2b:3c:4d:5e
  ip:   192.168.1.100

Detect MAC mismatch between BIOS and OS

If a NIC has been MAC-spoofed via Set-NetAdapterAdvancedProperty, the registry holds the override while WMI's PermanentAddress reports the burned-in MAC. A mismatch is a red flag during forensic review.

powershell

Get-NetAdapter | Select-Object Name,
    @{N='Current';E={$_.MacAddress}},
    @{N='Permanent';E={$_.PermanentAddress -replace '(..)(?=.)','$1-'}}

Output:

sql

Name      Current             Permanent
----      -------             ---------
Ethernet  02-1A-2B-3C-4D-5E   00-1A-2B-3C-4D-5E
Wi-Fi     A0-B1-C2-D3-E4-F5   A0-B1-C2-D3-E4-F5

The Ethernet adapter is running with a spoofed MAC (02-... prefix indicates locally administered).

Tool	Purpose
`Get-NetAdapter`	Modern PowerShell replacement (recommended)
`Get-NetAdapterAdvancedProperty`	Read/write driver-level NIC settings including MAC
`Get-NetIPConfiguration`	MAC + IP + DNS in one view
`arp -a`	MAC ↔ IP cache for other machines on the LAN
`ipconfig /all`	Per-adapter MAC under `Physical Address`
`Get-CimInstance Win32_NetworkAdapter`	WMI view (richer than `getmac /S`)
`Invoke-Command`	Modern remote query (replaces `getmac /S`)

Sources

Microsoft Learn — getmac — official syntax reference and remote-query semantics.
Microsoft Learn — Get-NetAdapter — recommended PowerShell replacement.
Microsoft Learn — Deprecated features in the Windows client — current status of legacy networking command-line tools.
Microsoft Learn — DHCP server administration — context for using getmac output to drive reservations.

getmac — MAC Address Query

What it is

Availability

Syntax

Essential options

Basic usage

Verbose output

CSV output for scripting

List output for readable display

Querying a remote machine

PowerShell equivalents

MAC address formatting and normalization

OUI lookup and vendor identification

Changing the MAC (driver override)

Common pitfalls

Real-world recipes

Extract just the MAC address for the Ethernet adapter

Build a MAC inventory from multiple machines

Grab the local MAC for a DHCP reservation script

Build a network inventory CSV across an OU with PowerShell

Generate DHCP reservation YAML from local MACs

Detect MAC mismatch between BIOS and OS

Related references

Sources