YES! I know most of you will tell me it's impossible, or it's restricted to manufacturers... However, after several weeks of heavy digging, I found the answer from Microsoft MSDN-Device Driver Development Kit, and Resource Kit. I wrote a detailed instructions on how to do this with screenshots at: http://www.kylelai.com/Change_MAC_w2k.htm Please send me an email at kyle@kylelai.com if you have any comments. Thanks, /Kyle

Well i went to check out our site. After raeding "NIC card" the firts 50 times I figured I would close it and come back later when I can figure out what a "Network Interface Card Card" is. I mean i know what a Network Interface Card is but not a Network Interface Card Card. Is that a card that plugs in to my Network Interface Card? And by the way AT&T broadband does not record the MAC address of your NIC and store it in a ARP table like some of the other ISP's that supply DSL. They do store the MAC of the cable modem. In which case you can not spoof!

are you really changing the MAC or are you just spoofing it? if you install the NIC in another machine will the MAC revert back to the original or will it keep the new MAC??

You are spoofing the "Software Assigned MAC Address", so you are spoofing MAC address on the Windows 2000 & XP at the time it reads the MAC address and stores in the kernel memory. This is different than changing the HARDWARE MAC address on the NIC card, which takes a lot more work. You can find that info at http://www.atstake.com/research/reports/acrobat/mac_address_cloning.pdf By the way, NIC Card= "Network Interface Card", at least that's my terminology... :) Sorry. Like PC Card = "PCMCIA Card" Card /Kyle Kyle Lai, CISSP, CISA, MCSE Information Security Consultant Kyle Lai Consulting kyle@kylelai.com www.kylelai.com

www.kylelai.com By the way, the method I discovered used NdisReadNetworkAddress function to overwrite the hardware MAC address. It works on almost all NIC out there. I haven't seen one that doesn't work, but not to say there isn't one out there. The following is Calvin Guan's response to my posting at Google: NdisReadNetworkAddress(...) is called by the network adapter driver to obtain a user specified MAC address in the registry. After the driver confirmed that there's a valid MAC address specified in the registry key, the driver then programs the MAC address to its hardware registers to override the burn-in MAC address. /Kyle Kyle Lai, CISSP, CISA, MCSE Information Security Consultant Kyle Lai Consulting kyle@kylelai.com www.kylelai.com

First, why would you want to change it? What are you tring to hide? Second, how do you know that you are changing it to a MAC that is NOT being used alread? Won't this cause trouble down the road, (slim chance to bump into the liget owner of the "real" MAC I know, but the possibility does exist).

Rick, Your concern is also my concern. That's why I put them into my disclaimers. I need to find a solution to change MAC address because I am in the information security, network security business. How can a organization fight network issues if they don't know the issues do exist? Now they should know there could be multiple MAC addresses in a LAN (for real, not just by arp spoofing). If they have a big LAN, they probably want to implement some intrusion detection, arpwatch type of system to protect themselves. /Kyle Kyle Lai, CISSP, CISA, MCSE kyle@kylelai.com www.kylelai.com