Windows NT 4.0

Windows NT 4.0
Version of Microsoft Windows
Logo
Screenshot
OS familyWindows NT
Version4.0
CodenameShell Update Release
Architecturex86 (PC/AT, PC-98), DEC Alpha, MIPS, PowerPC
Latest build4.0.1381.7097 (Service Pack 6a Security Rollup update)
Release date1996-08-24
Support end2004-06-30 (Workstation)
2004-12-31 (Server)
2006-07-11 (Embedded)
2006-12-31 (with Extended Security Updates)
Replaces
Windows NT 3.5x
Replaced by
Windows 2000

Windows NT 4.0 (codenamed Shell Update Release or Tukwila)[a] is a major version of Windows NT, which was released on 24 August 1996 as the successor to Windows NT 3.51 released a year before. It introduces the Windows 95 user interface to the Windows NT line, as well as includes major architectural changes to the operating system such as moving a large part of the graphics subsystem to kernel mode.

At launch, Windows NT 4.0 supported 486 and newer processors as well as MIPS, DEC Alpha and PowerPC. However, most of the ports were ultimately deprecated in the following years, with support for the last surviving non-x86 version for the DEC Alpha being dropped in August 1999.

This version originally launched in Workstation and Server editions. An Enterprise Edition of Windows NT Server 4.0 was released in 1997 and is designed for high-demand, high-traffic networks. The Terminal Server Edition (codenamed Hydra), introduced in 1998, allows users to log-in via a remote desktop client. Finally, Windows NT Embedded 4.0 (codenamed Impala) was launched in 1999, which allows developers to pick individual system components to build a custom version of Windows NT.

The Server and Workstation editions were succeeded by Windows 2000 on 17 February 2000. Windows NT 4.0 continued to be supported up to 2006 in various forms. A total of six Service Packs and a Security Rollup Package were released during its lifetime.

History[edit | edit source]

Development on Windows NT 4.0 (known internally as SUR) followed on from Windows NT 3.51 and NewShell (the Shell Technology Preview project that had ported the Windows 95 shell to Windows NT). During the development of NT 3.51, both the NT 3.51 and NewShell versions of various system components had been developed in parallel and one could copy the NewShell versions of DLLs over their NT 3.51 system to install the Windows 95 user interface. Starting with NT 4.0, the NewShell components were used as a baseline from the start, and the shell was fundamentally working, but

By the first available build of NT 4.0, Microsoft had already moved large parts of GDI and USER into kernel mode (the WIN32K.SYS kernel module), where previously they existed in user mode in the CSRSS process. This was done to improve performance, not only because graphical performance was generally sluggish on NT (and Microsoft had ambitions to bring NT into the graphical workstation market, beginning with NT 3.5's inclusion of OpenGL technology), but especially because the more graphically intensive Windows 95 shell highlighted the performance issues with running the graphics system in user mode. This did, however, cause a degradation in stability compared to Windows NT 3.x, since video drivers existed in the kernel's address space, meaning that a buggy driver could crash the entire system.

Windows NT 4.0 also included DirectDraw since build 1264, dropping support for DCI at the device-driver layer, though continuing to support the DCI Manager APIs for backwards compatibility purposes.

Editions[edit | edit source]

There are several editions of Windows NT 4.0:

Service Packs[edit | edit source]

There were 6 service packs released for Windows NT 4.0. Only Service Pack 1 was made available for the MIPS architecture, and Service Pack 2 was the final release for the PowerPC architecture. The last had been pulled by Microsoft due to a severe bug, which results in the revised Service Pack 6a. Microsoft had originally intended to release a seventh service pack for Windows NT 4.0, but eventually canceled it, and instead released an update rollup in 2001.[1][2]

Service Pack availability per architecture
Architecture SP1 SP2 SP3 SP4 SP5 SP6 SRP
x86 Yes Yes Yes Yes Yes Yes Yes
DEC Alpha Yes Yes Yes Yes Yes Yes No
PowerPC Yes Yes No No No No No
MIPS Yes No No No No No No

Option Pack[edit | edit source]

The Windows NT 4.0 Optional Pack was released in 1997 and includes server solutions and clients for Windows NT 4.0 Workstation, Server and Windows 95, including Personal Web Server, Transaction Server, Message Queue Client, FrontPage 98 Server Extensions, Management Console, Script Debugger, Windows Scripting Host, Data Access Components and Internet Information Services 4.0.

Installing the Option Pack requires Service Pack 3 to be installed. Installing it on Service Pack 4 and later will cause setup to show an information that the option pack was not tested on Service Pack 4 yet, but lets the user continue.

System requirements[edit | edit source]

The x86 version of Windows NT 4.0 requires a 486 processor, at least 16 MB of RAM, 110 MB of hard drive space (varies depending on components being installed), and a VGA or better display.[3] Windows NT 4.0 drops support for 80386 processors. Windows NT 4.0 allows installation to be possible without a floppy drive via CD-ROM media, although a floppy drive is required if one wants to make an Emergency Repair Disk or if not booting directly from the CD.

Hardware compatibility[edit | edit source]

Earlier releases of Windows NT 4.0 since build 1227 do not support processors with a CPUID higher than 3.[4] The system will crash during setup or boot if running without limiting the CPUID to less than 3, and before Service Pack 4, processors with CMPXCHG8b supported which vendor ID not GenuineIntel, AuthenticAMD or CyrixInstead will also crash during booting.[5][6]Service Pack 6 fully fixes this kernel issue.

Product Team credits Easter egg[edit | edit source]

Windows NT 4.0 contains the Product Team credits Easter egg from Windows 95. Like in Windows 95, it is implemented in SHELL32.DLL, and the steps to show it are much the same as in Windows 95; create a new folder and renaming it to each of the following names in order:

  • and now, the moment you've all been waiting for
  • we proudly present for your viewing pleasure
  • The Microsoft Windows NT Product Team!

The only main difference from the one in Windows 95 is that any references to "95" are replaced with "NT".

The text is in SHELL32.DLL's resource BIN and XORed with 0x95 as an obfuscation measure. For similar reasons, the Easter egg folder names are stored in the .text section of SHELL32.DLL as custom hashes of the old folder name concatenated with the new folder name. This was implemented by build 1175 and there shows the "SUR Shell Team" and "SUR Shell Test Team"; at some point after that the text was replaced by a message informing that "you won't find the credits here".

Source code leak[edit | edit source]

In early 2004, the source code for Windows NT 4.0 Service Pack 2 leaked online, together with a partial copy of the Windows 2000 source code.[7] The source of the leak was traced to Mainsoft, the developer of MainWin, an application that allowed developers to port existing Windows programs to Unix systems, whose development required access to selected portions of Windows source code under Windows Interface Source Environment program.[8] In response, Microsoft released the following statement:

On Thursday, February 12, Microsoft became aware that portions of the Microsoft Windows 2000 and Windows NT 4.0 source code were illegally made available on the Internet. Subsequent investigation has shown this was not the result of any breach of Microsoft's corporate network or internal security, nor is it related to Microsoft's Shared Source Initiative or its Government Security Program, which enable our customers and partners, as well as governments, to legally access Microsoft source code. Microsoft reaffirms its support for both the Shared Source Initiative and the Government Security Program.

Microsoft continues to work closely with the U.S. Federal Bureau of Investigation and other law enforcement authorities on this matter. Microsoft source code is both copyrighted and protected as a trade secret. As such, it is illegal to post it, make it available to others, download it or use it. Microsoft will take all appropriate legal actions to protect its intellectual property. These actions include communicating both directly and indirectly with those who possess or seek to possess, post, download or share the illegally disclosed source code.

Specifically, Microsoft is sending letters explaining to individuals who have already downloaded the source code that such actions are in violation of the law. Additionally, Microsoft has instituted the use of alerts on several peer-to-peer clients where such illegal sharing of the source code has taken place. These alerts are designed to inform any user who conducts specific searches on these networks to locate and download the source code that such activity is illegal.

Questions about the ongoing investigation should be referred to the FBI.

— Microsoft Corporation[9]

Despite the warnings, the archive containing the leaked code spread widely on the file-sharing networks and, even later, on open-source repository websites. On 16 February 2004, an exploit allegedly discovered by an individual studying the leaked source code for certain versions of Microsoft Internet Explorer was reported. On 15 April 2015, a repository containing the leaked NT 4.0 source code was removed from GitHub at Microsoft's request,[10] although other repositories hosting the Windows 2000 source code continued to exist in the same website; most of them were taken down by Microsoft's request on 9 April 2021.[11]

List of known builds[edit | edit source]

Beta 1[edit | edit source]

Beta 2[edit | edit source]

Release Candidate 1[edit | edit source]

Release Candidate 2[edit | edit source]

Pre-RTM[edit | edit source]

RTM[edit | edit source]

International Beta[edit | edit source]

Service Pack 1[edit | edit source]

Service Pack 2[edit | edit source]

Service Pack 3[edit | edit source]

Service Pack 4[edit | edit source]

Service Pack 5[edit | edit source]

Service Pack 6[edit | edit source]

Service Pack 6a[edit | edit source]

Security Rollup[edit | edit source]

Notes[edit | edit source]

  1. Most official documentation uses Shell Update Release or SUR. Tukwila is an internal name coined by Dave Cutler.

References[edit | edit source]