This question already has an answer here:

Is it possible to determine which, if any, Windows versions were previously installed on a machine?

Use case example: I'd like to find out if Windows 2012/2016 images we use were in-place upgrades or to be able to show that a machine has not been a fresh install since whatever version.

I've done some poking around within the registry, wmic, etc. but can't find any remnants that point to previously installed Windows versions.

marked as duplicate by Ramhound, Community Sep 12 at 16:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Look at old images of the HDD, since Restore Points and Registry can be changed or deleted. – DrMoishe Pippik Sep 12 at 15:09
  • @DrMoishePippik not sure I follow what you mean. Our "images" are deployed to VMware infrastructure, images are not stored within the OS. – TryTryAgain Sep 12 at 15:24
  • HDD images, backed up to other media, e.g. tape or another HDD – DrMoishe Pippik Sep 12 at 15:30
  • If you performed an in-placed upgrade from a previous version to the current version of Windows, after the grace period for the upgrade has past, there is little to no evidence the upgrade happend. There is no difference between an in-place upgrade to Windows Server 2016 and a clean install of Window Sever 2016 other than you have the option of keeping your data. – Ramhound Sep 12 at 15:55
  • 1
    Possible duplicate of How do I tell if Windows 10 was a fresh install or upgrade from 7/8?. You can either boot the VM and look at the key, or mount the HKEY_LOCAL_MACHINE hive file within your host OS, and look at the key that way. This key will be present for all versions upgrade to operating systems based on Windows 10. – Ramhound Sep 12 at 15:57

Browse other questions tagged or ask your own question.