The Media Access Control (MAC) address is the worldwide unique ID of a network adapter. You need the MAC address for a variety of management tasks—for instance, if you have to restrict access to your WiFi network to specific devices or assign images to computers in the Windows Deployment Services (WDS). Windows offers various ways to find the MAC address.

In most cases, you will want to import the MAC address of a NIC into the management console of an application. GUI tools such as msinfo32.exe are not practical for this task, so the command line is usually the better option.

ipconfig: often recommended but unsuitable ^

In most blogs and forums, ipconfig is recommended for reading the MAC address. To display the MAC address, you have to use the parameter /all, which spits out a clutter of information. This is particularly true if your machine contains multiple (virtual) adapters. To shorten the search results, you should use a filter:

ipconfig /all|findstr /V 00-00-00|findstr Physical

The first call of findstr removes all lines with empty MAC addresses. The second call finds all remaining lines with the IDs. Using ipconfig is cumbersome and is not an option if you have to read the MAC addresses remotely.

getmac: built for this purpose ^

The built-in Windows tool getmac is the perfect choice for this purpose. It is easy to use, supports remote queries, and can display results in a structured format:

getmac /s /fo csv /v

In this example, the MAC address of the PC with the IP is displayed in CSV format (parameter /fo csv) and in verbose mode (/v). You could redirect the output to a file and then store it in an environment variable with the setx command.

Remote access to the PC will only work if its firewall is configured to allow inbound WMI queries. If you receive the error message “Access denied,” you can configure the firewall with the following command:

netsh advfirewall firewall set rule group="windows management instrumentation (wmi)" new enable=yes.

wmic: read NIC properties ^

wmic is a pretty spartan client for WMI queries. It also supports reading the MAC address through the alias NIC:

wmic /node: NIC get description,macaddress

This query extracts the description and the MAC address from the extensive information that WMI provides about the adapter. Other useful attributes that you could retrieve with wmic are “manufacturer” or “productname.”

The advantage of wmic over other tools is that you can access exactly the information you require. For example, if you only need the MAC addresses of the physical adapters and not those of the numerous virtual adapters, you could run the following query:

wmic /node: NIC where PhysicalAdapter='true' get description,macaddress

Here, too, note that the firewall on the remote computer must allow WMI queries.

arp: find MAC address of an IP address ^

The main purpose of the Address Resolution Protocol (ARP) is to resolve the MAC address for a specific IP address. The MAC address is required if an IPv4 packet has to be encapsulated into an Ethernet frame. You can use this fact by first connecting to a remote computer and read the MAC address afterwards with the arp command. For this purpose, a simple ping is enough to find the machine in the arp list:

Subscribe to 4sysops newsletter!

ping -4
arp -a

You can’t format the arp output as you can with getmac or wmic; however, the output is easy to read because it only contains the essential information. The main advantage of arp compared to the WMI-based tools is that you don’t have to configure the firewall on the target computer.

  1. timestride 8 years ago

    Nice article. I have never run across the getmac command, so that was a bit of a revelation. I had always used arp -a, however it has some several limitations. Since ARP functions at layer 2, you have to be on the same subnet for it to work.

  2. miguel 8 years ago

    Good !!

  3. Rafael 8 years ago

    Very useful. Thanks for sharing

  4. Matthew Koundakjian 8 years ago

    Appreciate the post, as I didn’t know about getmac either.

    Is there a more generic mechanism, for systems other than Windows? ping then arp works for local machines, as the commenter timestride says, but that’s the only of the bunch that works with non-Windows machines.

    Also, is getmac using WMI?

  5. Hossein 8 years ago

    Good job…..Very useful. Thanks for sharing

  6. Anthony Maw 8 years ago

    Although the MAC address is burned into the card at the time of manufacturing, some network cards allow their MAC addresses to be arbitrarily set through the device driver software. MAC addresses should not be relied upon solely for access control filtering and MAC address spoofing is a well-known security risk.

  7. George 7 years ago

    More about WMIC Commands


  8. Rhino 6 years ago

    Hi, is there any way to check if device is connected to the network, when you know only MAC address? In case no device IP set, so it is unknown.

Leave a reply

Your email address will not be published.


© 4sysops 2006 - 2022


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account