... please wait while loading ...

To view the complete site without permanently having to scroll, your browser-window should be maximized to support your screen-resolution of . Windows XP robots

What's New

One months of additions are listed here.

A. NT actually stands for Northern Telecom but Microsoft licensed it and in the Windows sense stands for New Technology. Its also interesting to note its heritage
RSX -> VMS -> ELN -> NT all major designs of David Cutler
Also VMS +1 letter = WNT (Windows NT) :-) (aka HAL and IBM in 2001)

Q. What is the NT Boot Process?

A. Firstly the files required for NT to boot are

Ntldr - This is a hidden, read-only system file that loads the operating system
Boot.ini - This is read-only system file, used to build the Boot Loader Operating System Selection menu on Intel x86-based computers
Bootsect.dos - This is a hidden file loaded by Ntldr if another operating system is selected
Ntdetect.com - This is a hidden, read-only system file used to examine the hardware available and to build a hardware list.
Ntbootdd.sys - This file is only used by systems that boot from a SCSI disk.

The common Boot sequence files are

Ntoskrnl.exe - The Windows NT kernel
System - This file is a collection of system configuration settings
Device drivers - These are files that support various device drivers
Hal.dll - Hardware Abstraction Layer software

The boot sequence is as follows

Power on self test (POST) routines are run
Master Boot Record is loaded into memory, and the program is run
The Boot Sector from Active Partition is Loaded into Memory
Ntldr is loaded and initialized from the boot sector
Change the processor from real mode to 32-bit flat memory mode
Ntldr starts the appropriate minifile system drivers. Minifile system drivers are built into Ntldr and can read FAT or NTFS
Ntldr reads the Boot.ini file
Ntldr loads the operating system selected, on of two things happen
* If Windows NT is selected, Ntldr runs Ntdetect.com
* For other operating system, Ntldr loads and runs Bootsect.dos and passes control to it. The Windows NT process ends here
Ntdetect.com scans the computer hardware and sends the list to Ntldr for inclusion in HKEY_LOCAL_MACHINE\HARDWARE
Ntldr then loads Ntoskrnl.exe, Hal.dll and the system hive
Ntldr scans the System hive and loads the device drivers configured to start at boot time
Ntldr passes control to Ntoskrnl.exe, at which point the boot process ends and the load phases begin

Q. What is Virtual Memory?

A. Virtual Memory makes up for the lack of RAM in computers by using space on the hard disk as memory, Virtual Memory. When the actual RAM fills up (actually its before the RAM fills) then virtual memory is created on the hard disk. When physical memory runs out, the Virtual Memory Manager chooses sections of memory that have not been recently used and are of low priority and writes them to the swap file. This process is hidden from applications, and applications views both virtual and actual memory as the same.

Each application that runs under Windows NT is given its own virtual address space of 4GB (2GB for the application, 2GB for the operating system).

The problem with Virtual Memory is that as it writes and reads to the hard disk, this is much slower than actual RAM. This is why if an NT system does not have enough memory it will run very slowly.

Q. What is the history of NT?

A. In the late 1980's the Windows environment was created to run on the Microsoft DOS operating system. Microsoft and IBM joined forces to create a DOS replacement that would run on the Intel platform that led to the creation of OS/2, and at the same time Microsoft was working on a more powerful operating system that would run on other processor platforms. The idea was that the new OS would be written in a high level language (such as C) so it would be more portable.

Microsoft hired Dave Cutler (who also designed Digital's VMS) to head the team for the New Technology Operating System (NT :-) ). Originally the new OS was to be called OS/2 NT.

In the early 1990's Microsoft released version 3.0 of its windows OS which gained a large user base, and it was at this point that Microsoft and IBM's split started as the two companies disagreed on the future of their OS's. IBM viewed Windows as a stepping stone to the superior OS/2, where as Microsoft wanted to expand Windows to compete with OS/2, so they split, IBM kept OS/2 and Microsoft change OS/2 NT to Windows NT.

Nt was once called OS/3, and OS/2 V3, I am informed by a alpha tester for IBM & MS, he had a set of 5.25 diskettes from Microsoft, and that's how he got them.

The first version of Windows NT (3.1) was released in 1993 and had the same GUI as the normal Windows Operating System, however it was a pure 32 bit OS, but provided the ability to also run older DOS and Windows apps, as well as character mode OS/2 1.3 programs.

For a detailed history have a look at http://windowsnt.miningco.com

Q. How do I install the SYMBOL files?

A. Symbol files are produced by the linker when a program is built, and are used to resolve global variables and function names in an executable.

Create a directory on your machine called SYMBOLS
mkdir c:\winnt\symbols
Copy over the symbols from the NT installation CD ROM
xcopy <CD-ROM>:\Support\Debug\i386 c:\winnt\symbols /s
If you have any service pack symbols you should extract these to the same directory, e.g. for Service Pack 2
SYM_400I -d c:\winnt\symbols

For more information see Microsoft Knowledge Base article Q148659

Q. What is Windows NT?

A. Windows NT (both the Workstation and Server) is a 32-bit Operating System. It is a preemptive, multi-tasking Operating System, which means that the Operating System controls allocation of CPU time, not the applications, stopping one application from hanging the OS. NT supports multiple CPU's giving true Multi-tasking, using symmetrical multiprocessing, meaning the processors share all tasks, as opposed to asymmetrical multiprocessing, where the OS uses one CPU and the applications another. NT is also a Fault Tolerant Operating System, with each 32bit application operating in its own Virtual Memory address space (4 GigaBytes) which means one application cannot interfere with another's memory space.

Unlike earlier version of Windows (such as Windows for Workgroups and Windows 95), NT is a complete Operating System, and not an addition to DOS.

NT supports different CPU's: Intel x86, IBM PowerPC (Not to be supported for NT5.0) and DEC Alpha.

NT's other main plus is its Security with a special NT file system (NTFS) that allows permissions to be set on a file and directory basis.

Q. What is the Registry?

A. Originally there were .ini files in Windows, however the problem with .ini files are many, e.g. size limitations, no standard layout, slow access, no network support etc. Windows 3.1 (yes Windows not Windows NT) had a registry which was stored in reg.dat and could be viewed using regedit.exe and was used for DDE, OLE and File Manager integration. In Windows NT the Registry is at the heart of NT and is where nearly all information is stored, and is split into a number of subtrees, each starting with HKEY_ to indicate that it is a handle that can be used by a program.

HKEY_LOCAL_MACHINE	This contains information about the hardware configuration and installed software.
HKEY_CLASSES_ROOT	This is just a link to HKEY_LOCAL_MACHINE\SOFTWARE\Classes and contains links between applications and file types as well as information about OLE.
HKEY_CURRENT_CONFIG	Again this is a link to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Hardware Profiles\Current and contains information about the current configuration.
HKEY_CURRENT_USER	This is a link to HKEY_USERS\<SID of User> and contains information about the currently logged on users such as environment, network connections, printers etc.
HKEY_USERS	Contains information about actively loaded user profiles, including .default which is the default user profile.

Each of the subtrees has a number of keys, which in turn have a number of subkeys. Each key/subkey can have a number of values which has 3 parts

The name of the value, e.g. Wallpaper
The type of the value, e.g. REG_SZ (which is a text string)
The actual value of the value, e.g. "c:\winnt\savilltech.bmp"

To edit the registry there are two tools available, regedt32.exe and regedit.exe.Regedit.exe has better search facilities, but does not support all of the Windows NT registry value types. If you want to just have a look around the Registry:

Start a registry editor (regedit.exe or regedt32.exe)
In Regedt32.exe you can set the registry to read only mode which means you won't corrupt anything :-) (Options - Read Only Mode)
Select the HKEY_USERS subkey
Move to the .default - Control Panel - Desktop and you will see a number of values in the right hand pane.
One of them is wallpaper and this is the background that is displayed before you logon.

Q. What files make up the registry, and where are they?

A. The files that make up the registry are stored in %systemroot%/system32/config directory and consist of

SAM - HKEY_LOCAL_MACHINE\SAM
SECURITY - HKEY_LOCAL_MACHINE\Security
software - HKEY_LOCAL_MACHINE\Software
system - HKEY_LOCAL_MACHINE\System & HKEY_CURRENT_CONFIG
default - HKEY_USERS\.DEFAULT
Ntuser.dat - HKEY_CURRENT_USER (this file is stored in %SystemRoot%\Profiles\%username%)

There are also other files with different extensions for some of them

.alt - Contains a backup copy of the HKEY_LOCAL_MACHINE\System hive. Only System has a .alt file
.log - A log of changes to the keys and values for the hive
.sav - A copy of the hive as it looks at the end of the text mode stage in setup

Q. How do I restrict access to the registry editor?

A. Using the registry editor (regedt32.exe)

Highlight HKEY_USERS and Load Hive from the Registry menu.
Browse to the users profile directory who you want to restrict the registry tools for and select NTUser.dat.
When prompted for Key Name, input their UserID.
Navigate to \Software\Microsoft\Windows\CurrentVersion\Policies.
If no System sub-key exists, Add Key. Then Add Value of DisableRegistryTools (under the System key) using type REG_DWORD and set it to 1.
Unload Hive from the Registry menu.

Q. What is the maximum registry size?

A. The maximum size is 102MB, however it is slightly more complicated than this.

The registry entry that controls the maximum size of the registry is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RegistrySizeLimit. By default this entry will not exist so it will need to be created:

Start the registry editor (regedit.exe)
Move to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control key
From the Edit menu, select New - DWord value and enter the name as RegistrySizeLimit
Double click the new entry and enter a value in bytes (choose decimal as the type)

The minimum size is 4MB, and if anything less than this is entered in the registry then it will be forced up to 4MB. The maximum is 80% of the paged pool (which has a maximum size of 128MB, hence 102MB which is 80% of 128MB). If no entry is entered then the maximum size is 25% of the paged pool. The paged pool is an area of physical memory used for system data that can be written to disk when not in use.

An important point to note is that the RegistrySizeLimit is a maximum, not an allocation, and so setting a high value will not reserve the space, and it does not guarantee the space will be available.

This can also be configured using the System Control Panel applet, click on the Performance tab and the maximum registry size can be set there. You would then need to reboot.

For more information see Knowledge Base Article Q124594

There is another complication, during early boot, NTLDR loads some code, allocates working memory, and reads in parts of the registry. All of this has to fit in the first 16MB of memory regardless of how much memory is physically installed. The entire system file is read; enough memory is required to contain the whole file as stored on disk without regard to how much of it is useful.

Some problems

The registry contains wasted space (sometimes a LOT). Try saving the SYSTEM key from REGEDT32 and then comparing the saved file size with that of the SYSTEM hive in \%systemroot%\system32\config\. On one machine, I reduced the SYSTEM hive from 9,720 KB to 864 KB in this manner.
Creation of the LastKnownGood ControlSet (usually #2) soon after boot almost doubles the size of the file. Depending on circumstances, such as reclaimable space in the "gas", additions to the registry may require new space to be allocated beyond the end of the combined Current and LastKnownGood SYSTEM hive. Now after the next boot, another LastKnownGood is tacked onto the end of the file, adding about a third to its size. In my case, a registry with a "true" size of 4MB was thus inflated to 12MB and caused boot failure.

A number of ways to get rid of the excess space:

If FAT, merely boot from DOS floppy, then replace the SYSTEM file
If NTFS, boot from another NT partition and replace file in previous partition
Use REGBACK/REGREST from the NT reskit. [maybe easiest of all]
Run RDISK, shutdown, and repair the system. Make sure you use RDISK /s when using this to also backup the user database.
Use ERD Commander from Winternals Software

To turn this off use REGEDT32 to add the value "ReportBootOk:REG_SZ:0" [zero] to HKEY_Local_Machine\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon This will prevent creation of the LastKnownGood ControlSet. If a boot fails because the 16 MB limit with NTLDR is exceeded, no dump can be produced and MS will not solve the problem. This 16 MB problem will not be changed in NT 5.

Q. Should I use REGEDIT.EXE or REGEDT32.EXE?

A. You can use either for NT. REGEDIT does have a few limitations, the largest is that it does not support the full regedit data types such as REG_MULTI_SZ, so if you edit this type of data with REGEDIT it will change its type.

REGEDIT.EXE is based on the Windows95 version and has features that REGEDT32.EXE lacks (such as search). In general REGEDIT.EXE is nicer to work with. REGEDIT.EXE also shows your current position in the registry at the bottom of the window.

Q. How do I restrict access to a remote registry?

A. Access to a remote registry is controlled by the ACL on the key winreg.

Start the registry editor (regedt32.exe)
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers
Check for a key called winreg. If it does not exist create it (Edit -Add Key)
Select the winreg key (by clicking on it)
From the Security menu select permissions
Click the Add button and give the user you want read access
Once added, click on the user and select "Special Access"
Double click on the user and you can select which actions the user can perform
Click OK when finished

It is possible to set up certain keys to be accessible even if the user does not have access by editing the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg\AllowedPaths\Machine (use regedt32). You can add paths to this list.

Q. How can I tell what changes are made to the registry?

A. Using the regedit.exe program it is possible to export portions of the registry. This feature can be used as follows:

Start the registry editor (regedit.exe)
Select the key you want to monitor
From the Registry menu select "Export registry file"
Enter a file name (notice if you want to export the whole registry just select the "Export Range All") and click OK
Perform the change (install some software or change a system parameter)
Rerun steps 1 to 4 using a different file name
Run the two files through a comparison utility (for example windiff.exe)
If you are using windiff, select Compare Files from the File menu and you will then be prompted to select the 2 files to compare.
Once compared a summary will be displayed stating if there are differences, to view the changes double click on the message
Press F8 to view the next change (or select next change from the view menu)
You have now found what changed!

Q. How can I delete a registry value/key from the command line?

A. Using the Windows NT Resource Kit Supplement 2 utility REG.EXE you can delete a registry value from the command line or batch file, e.g.

reg delete HKLM\Software\test

Would delete the HKEY_LOCAL_MACHINE\Software\test value. When you enter the command you will be prompted if you really want to delete, enter Y. To avoid the confirmation add /f to the command, e.g.

reg delete HKLM\Software\test /f

A full list of the codes to be used with REG DELETE are as follows:

HKCR	HKEY_CLASSES_ROOT
HKCU	HKEY_CURRENT_USER
HKLM	HKEY_LOCAL_MACHINE
HKU	HKEY_USERS
HKCC	HKEY_CURRENT_CONFIG

To delete a entry on a remote machine add the name of the machine, \\<machine name>, e.g.

reg delete HKLM\Software\test \\johnpc

Q. How can I audit changes to the registry?

A. Using the regedt32.exe utility it is possible to set auditing on certain parts of the registry. I should note that any type of auditing is very sensitive lately and you may want to add some sort of warning letting people know that their changes are being audited.

Start the registry editor (regedt32.exe)
Select the key you wish to audit (e.g. HKEY_LOCAL_MACHINE\Software)
From the Security menu select Auditing
Check the "Audit Permission on Existing Subkeys" if you want subkeys to also be audited
Click the Add button and select the users you want to be audited, click Add and then click OK
Once there are names in the "Names" box you can select which events to be audited, whether success or failure.
When you have filled in all the information click OK

You will need to make sure that Auditing for File and Object access is enabled (use User Manager - Polices - Audit).

To view the information use Event Viewer and look at the Security information.

Q. How can I clean up/remove invalid entries from the registry?

A. Microsoft have released a utility called RegClean which will go through your machines registry and delete any unused/unnecessary keys. The current version is 4.1a and can be downloaded from http://support.microsoft.com/download/support/mslfiles/RegClean.exe .

Once downloaded just click on the Executable and it will check your registry, once the check is completed you will be given an option to fix errors "Fix Errors" button. You can click the Exit button to exit.

RegClean creates an uninstall file in the directory the image is located in, of the name

"Undo <machine name> <yyyymmdd> <hhmmss>.reg"
e.g. "Undo workstation 19980320 104323.reg"

To undo the changes just double click (or single depending on your config ;-) ) this file.

See http://support.microsoft.com/support/kb/articles/q147/7/69.asp for more information.

Q. I make changes to HKEY_LOCAL_MACHINE\HARDWARE but they are lost on reboot.

A. This is because HKEY_LOCAL_MACHINE\HARDWARE is recreated by the system at boot time and this means any settings such as ACL's are lost. The rest of HKLM (SOFTWARE, SYSTEM, SAM, SECURITY) is stored on disk, and is not recreated during system boot.

Q. What data types are available in the registry?

A. Below is a table of data types supported by Regedt32.exe, regedit.exe does not support REG_EXPAND_SZ or REG_MULTI_SZ

REG_BINARY	This is raw binary data
REG_DWORD	This is a double word (4 bytes). It can be displayed in binary, hexadecimal or decimal format
REG_EXPAND_SZ	An expandable text string that contains a variable (for example %systemroot%)
REG_MULTI_SZ	A multiple line string. Each "line" is separated by a null
REG_SZ	A text string

Q. How can I automate updates to the registry?

A. There are 2 main methods you can use to create scripts that can be run to automate the updates. The first is to create a .reg file which can then be run using

regedit /s <reg file>

The format of the file is

REGEDIT4 [<key name>] "<value name>"="<value>" a string value"<value name>"=hex:<value> a binary value"<value name>"=dword:<value> a dword value

for example

REGEDIT4

[HKEY_USERS\.DEFAULT\Control Panel\Desktop] "Wallpaper"="E:\\WINNT\\savtech.bmp" "TileWallpaper"="0"

[HKEY_USERS\.DEFAULT\Control Panel\Colors] "Background"="0 0 0"

Would set the default background and color before anyone logs on.

The second method is to user a Windows 95 style .inf file. These are run using the command

rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 <inf file>

The format of the file is as follows

[Version] Signature = "$Windows NT$" Provider=%Provider%

[Strings] Provider="SavillTech Ltd"

[DefaultInstall] AddReg = AddReg DelReg = DelReg UpdateInis = UpdateInis

[AddReg] [DelReg] [UpdateInis]

Below are the keys to be used

HKCR	HKEY_CLASSES_ROOT
HKCU	HKEY_CURRENT_USER
HKLM	HKEY_LOCAL_MACHINE
HKU	HKEY_USERS

The file below is an .inf file which performs the same as the .reg file described earlier

[Version] Signature = "$Windows NT$"

[DefaultInstall] AddReg = AddReg

[AddReg] HKU,".DEFAULT\Control Panel\Colors","Background",0000000000,"0 0 0" HKU,".DEFAULT\Control Panel\Desktop","Wallpaper",0000000000,"E:\WINNT\savtech.bmp" HKU,".DEFAULT\Control Panel\Desktop","TileWallpaper",0000000000,"1"

INF files can be generated automatically using the SYSDIFF utility if you have a difference file (sysdiff /inf <name of difference file> <dir to create to>)

Q. How do I apply a .reg file without the success message?

A. To apply a .reg file (a registry information file) the normal method from the command prompt is to enter

C:\> regedit <registry file>.reg

This applies the change and gives a confirmation message:

"Information is <filename>.reg has been successfully entered into the registry"

If you would like to avoid this confirmation message and apply the change silently use the /s switch, e.g.

C:\> regedit /s <registry file>.reg

Q. How can I remotely modify the maximum registry size?

A. The maximum registry size is usually defined using the System properties control panel applet, Performance tab. When you change this value all it actually does is to update the registry entry

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\RegistrySizeLimit

You could therefore modify this from the command line using a registry script. For example

REGEDIT4

[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control] "RegistrySizeLimit"="24000000"

Run using

C:\> regedit /s <reg name>

You could add this to a login script.

Alternatively run remotely by submitting with the AT command. The change will not take effect until the machine reboots. If you wanted the reboot to occur you could add a reboot using the Resource Kit SHUTDOWN.EXE utility (as explained in
Q. How can I configure the machine to reboot at a certain time?)

Q. I can't update DWORD values using REG.EXE.

A. There is a bug in REG.EXE supplied with the NT 4.0 resource kit. Download a fixed version from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/nt40/i386/reg_x86.exe

Q. How can I install a .inf file from the command line?

A. The normal method to install a .inf file is to right click on it and select Install from the context menu however it is also possible to install from the command line. The syntax is:

C:\> rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 .\<file>.inf

Q. How can I compress the registry?

A. The following procedure can be used to compact the registry files, but also to restore the 'repair disk data' when you messed up the registry:

1) As always, make sure you have a backup of you're system, including the registry

2) Run Start: "RDISK /S-". This automatically updates the repair info located under %systemroot%\repair. The registry data are reorganized and compressed.

3) Next step is to expand these files to a temporary location.

EXPAND %systemroot%\REPAIR\DEFAULT._ %temp%\DEFAULT EXPAND %systemroot%\REPAIR\SAM._ %temp%\SAM EXPAND %systemroot%\REPAIR\SECURITY._ %temp%\SECURITY EXPAND %systemroot%\REPAIR\SOFTWARE._ %temp%\SOFTWARE EXPAND %systemroot%\REPAIR\SYSTEM._ %temp%\SYSTEM

4) Check your %temp% folder and %systemroot%\system32\config to find the difference in size between the different files that make up the registry. Probably the SOFTWARE hive will have a remarkable difference. In my case it shrinked from over 10Mb to 3.5Mb.

5) The registry files in %systemroot%\system32\config should be replaced by the reorganized ones in your %temp% folder. You can do this by:

Booting to DOS or Win3.x/95/98 and simply replace the files (in case your system files are on a FAT partition).
Replacing these files while booting from a second Windows NT installation.
Or by using the MV command (move) from the Resource Kit to move these files at boot-time:
MV /X /D %temp%\DEFAULT %systemroot%\SYSTEM32\CONFIG\DEFAULT MV /X /D %temp%\SAM %systemroot%\SYSTEM32\CONFIG\SAM MV /X /D %temp%\SECURITY %systemroot%\SYSTEM32\CONFIG\SECURITY MV /X /D %temp%\SOFTWARE %systemroot%\SYSTEM32\CONFIG\SOFTWARE MV /X /D %temp%\SYSTEM %systemroot%\SYSTEM32\CONFIG\SYSTEM

When I performed these steps I notices a serious performance gain during system startup.

Q. What service packs and fixes are available?

A. See table below. All directories are off of ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40. Just click on the file name for a direct FTP link For people in Europe ftp.sunet.se/pub3/vendor/microsoft/bussys/winnt/winnt-public/fixes may provide faster access.

There are also Microsoft BBS numbers where Service Packs can be downloaded from, e.g. for the UK it is 44 1734 270065, however the fixes tend to be a few days later than on the FTP site.

File Name	Directory	Description (Microsoft Article No.)	Hotfixes
Sp1_400i.exe	/ussp1/i386	Service Pack 1	PostSP1
Sp2_400i.exe	/ussp2/i386	Service Pack 2 (around 14MB)	PostSP2
Nt4sp3_i.exe	/ussp3/i386	Service Pack 3 (around 18MB)	PostSP3
NT4SP4I.EXE	NA	Service Pack 4 (around 33MB)	PostSp4
SP5I386.EXE	NA	Service Pack 5 (around 34.5MB)	PostSp5

Service Pack 1 Hotfixes /hotfixes-postsp1/

KRNL40I.EXE	/32proc-fix	Q140065
AFD40I.EXE	/afd-fix	Q140059
CDFS40I.EXE	/cdfs-fix	Q142687
NDIS40I.EXE	/mcanet-fix	Q156324
NDIS40I.EXE	/ndis-fix	Q142903
NTBCKUPI.EXE	/NTBackup-fix	Q142671
NTVDM40I.EXE	/ntvdm-fix	Q134126
PCM40_I.EXE	/pcmcia-fix	Q108261
SCSIFIXI.EXE	/scsi-fix	Q171295
SPX40I.EXE	/spx-fix	Q153665
SYN40I.EXE	/syn-attack	Q142641
NTFS40I.EXE	/toshiba-fix	Q150815
STONE97I.EXE	/winstone97	Q141375

Service Pack 2 Hotfixes /hotfixes-postsp2/

ALPHA40.EXE	/Alpha-fix	Q156410
DNS40I.EXE	/dns-fix	Q142047, Q162927
IISFIX.EXE	/iis-fix	Q163485, Q164059
KRNL40I.EXE	/krnl-fix	Q135707, Q141239
TCP40I.EXE	/oob-fix	Q143478
RAS40I.EXE	/ras-fix	Q161368
RPC40I.EXE	/RPC-fix	Q159176, Q162567
SECFIX_I.EXE	/sec-fix	Q143474
SERIALI.EXE	/serial-fix	Q163333
SETUPDDI.EXE	/setupdd-fix	Q143473
SFMSRVI.EXE	/sfmsrv-fix	Q161644
WTCP40I.EXE	/TCPIP-fix	Q163213

Service Pack 3 Hotfixes /hotfixes-postsp3/

2GCRASHI.EXE	/2gcrash	Q173277
ASPFIX.EXE	/asp-fix	Q165335
ATA-FIXI.EXE	/atapi-fix	Q183654
DNSFIX_I.EXE	/dns-fix	Q142047
EUROFIXI.EXE	/euro-fix	Q182005
ADMNFIXI.EXE	/getadmin-fix	Q146965
IDEFIX-I.EXE	/ide-fix	Q153296
IIS-FIXI.EXE	/iis-fix	Q143484
IIS4FIXI.EXE	/iis4-fix	Q169274
JOY-FIXI.EXE	/joystick-fix	Q177668
NDISFIXI.EXE	/ndis-fix	Q156655
NBTFIX-I.EXE	/netbt-fix	Q178205
PCMFIX-I.EXE	/pcm-fix	Q180532
PENTFIX.EXE	/pent-fix	Q163852
PPTPFIXI.EXE	/pptp2-fix	Q167040
PPTPFIXI.EXE	/pptp3-fix	Q189595
PRIVFIXI.EXE	/priv-fix	Q190288
PRNTFIXI.EXE	/Prnt-fix	Q181022
ROLL-UPI.EXE	/roll-up	Q147222
RRASFIXI.EXE	/rras20-fix	Q168469
RRASFIXI.EXE	/rras30-fix	Q189594
DCOMFIXI.EXE	/SAG-fix
SCSIFIXI.EXE	/scsi-fix	Q171295
SFM-FIXI.EXE	/sfm-fix	Q166571, Q170965, Q172511, Q177644, Q178364, Q180622, Q180716, Q180717, Q180718 & Q185722
CHARGENI.EXE	/simptcp-fix	Q154460
SNK-FIXI.EXE	/snk-fix	Q193233
SRVFIX-I.EXE	/srv-fix	Q180963
SSL-FIXI.EXE	/ssl-fix	Q148427
TAPI21FI.EXE	/tapi21-fix	Q179187
TEARFIXI.EXE	/teardrop2-fix	Q179129
Y2KFIXI.EXE	/Y2k-fix	Q196548
WANFIX-I.EXE	/wan-fix	Q163251
WINSFIXI.EXE	/winsupd-fix	Q155701
Y2KFIXI.EXE	/y2k-fix	Q175093, Q180122, Q183123 & Q183125
ZIP-FIXI.EXE	/zip-fix	Q154094

A number of post Service Pack 3 hotfixes have been replaced by newer fixes and are not listed above, they can be found at ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/archive . These include

dbclclick-fix
icmp-fix
java-fix
land-fix
lsa-fix
mdl-fix
oob-fix
pptp-fix

Service Pack 4 Hotfixes /hotfixes-postsp4/

A post Service Pack 4 hotfix rollup has been released and can be downloaded from:
http://www.microsoft.com/ntserver/nts/downloads/recommended/nt4postsp4hotfix/

Individual hotfixes are:

CLIKFIXI.EXE	/Clik-fix	Q195540
DISCFIXI.EXE	/Disc-fix	Q221331
GINAFIXI.EXE	/Gina-fix	Q214802
MSMQFIXI.EXE	/MSMQ-fix	Q230050
MSV-FIXI.EXE	/Msv1-fix	Q214840
NPRPCFXI.EXE	/Nprpc-fix	Q195733
SP4HFIXI.EXE	/roll-up	Q195734
RNR-FIXI.EXE	/Rnr-fix	Q214864, Q216091, Q217001
SCRNSAVI.EXE	/Scrnsav-fix	Q221991
SMSFIXI.EXE	/Sms-fix	Q196270
SMSSFIXI.EXE	/Smss-fix	Q218473
TCPIPFXI.EXE	/Tcpip-fix	Q195725
Y2KUPD.EXE	/Y2KUPD	Q218877, Q221120

Service Pack 5 Hotfixes /hotfixes-Postsp5/

RASFFIXI.EXE	/RAS-fix	Q230677
PWDFIXI.EXE	/RASPassword-fix	Q230681
RPWDFIXI.EXE	/RRASPassword-fix	Q233303
WINHLP-I.EXE	/Winhlp32-fix	NA

The file names above are for the Intel platform (hence the ending I), but they may also be available for Alpha and PPC, just substitute the I for a A(Alpha) or P(PPC).

I should note a health warning, "If it ain't broke, don't fix it" and I would tend to agree with this, so unless you have a problem, or require a new feature of a Service Pack think if you really want it. Also if you are going to apply it to a live system, try and test it first, as sometimes a Service Pack will introduce new problems.

Q. What are the Q numbers and how do I look them up?

A. The Q numbers relate to Microsoft Knowledge Base articles and can be viewed at http://support.microsoft.com/support/

Q. How do I install the Service Packs?

A. If you receive the Service Pack by downloading from a Microsoft FTP site, then copy the file to a temporary directory and then just enter the file name (e.g. Sp2_400i.exe). The file will be expanded and among the files created a file called UPDATE.EXE will be created. Just run this file. If there is no UPDATE.EXE, just .sym files you have downloaded the symbols version which is used for debugging NT, download the normal version (see above).

If you receive Service Packs via CD, if you just insert the CD (for SP2 and later) and an Internet Explorer page will be shown and you can just click on install for the Service Pack.

Q. How do I install the Hot fix?

A. Again copy the file to a temporary directory and run the file name. A few files will be created, one called HOTFIX.EXE. Run "HOTFIX /install" which will install the Hot Fix.

The newer Hot fixes (Java fix for Service Pack 3 onwards) you just double click on the downloaded file.

Q. How do I remove a Hot fix?

A. Use the command Hotfix /remove to remove a hotfix. Before you can do this you will need to expand the original hotfix file using the <hotfix> /x command.

To force the remove using the registry editor (regedt32) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\HOTFIX and delete the entry for the HOTFIX. Then use explorer to goto %SystemRoot%\HOTFIX\HF00?? and copy the backed up files back to their original location.

Q. How do I install Service Pack 3?

A. Before you install Service Pack 3 you must remove Internet Explorer 4.0 preview if installed:

From Control Panel (Start - Settings - Control Panel) double click Add/Remove Programs
Select "Microsoft Internet Explorer 4.0" and click Add/Remove
Select Remove All
You will have to reboot

Also before installing SP3 make sure you have an up to date Repair Disk (RDISK /S). To install Service Pack 3 download Nt4sp3_i.exe and follow the instructions below

Double click nt4sp3_i.exe
It will verify the file and then uncompress to a temporary area (you can make it uncompress without installing by typing nt4sp3_i /x)
Click Next to install and click Yes to accept the license agreement
Click Next and then select "Yes create uninstall"
Click Next then Finish
You will then have to reboot

Q. Emergency Repair Disk issues after installation of Service Pack 3.

A. Due to changes in Service Pack 3 the Emergency Repair Disk process has changed. The file setupdd.sys that is on the 2nd NT installation disk has been superseded by the one supplied with service pack 3. To extract the file from the Service Pack 3 executable, follow the instructions below:

Copy nt4sp3_i.exe to a temporary area
Uncompress the service pack
nt4sp3_i /x
Insert the second NT installation disk (do not use the originals, create a new set using winnt32 /ox)
Set the file setupdd.sys to write enabled
attrib -r a:\setupdd.sys
Copy the new setupdd.sys to the 2nd installation disk
copy setupdd.sys a:

This is discussed in the Service Pack 3 readme file, and also in knowledge base article Q146887.

Q. How do I remove the Java Hotfix for Service Pack 3?

A. Manually unpack the hotfix
javafixi /x
Then type
hotfix -y
And it will remove the hotfix.

This method may become the new standard for hot fixes.

Q. How do I install multiple Hotfixes at the same time?

A. When you extract the files in a hotfix, generally the following will be extracted

hotfix.exe
hotfix.inf
a number of executables/drivers/sys files etc (usually one file)

The hotfix.exe is the same executable for all the hotfixes, and the hotfix.inf is basically the same, the only difference is the files that are to be copied, e.g. tcpip.sys, and a description of the hotfix. To install multiple hotfixes at the same time all that is needed is to decompress the hotfix files and update the hotfix.inf with the information on which files to copy.

Create a directory on a disk called hotfix
md hotfix
From the command line decompress the hotfixes you wish to install, note each time you decompress a hotfix a new hotfix.inf will overwrite the existing one so you may wish to backup the .inf files
- <hotfix name> /x, e.g. javafixi /x
- you will be asked where to extract the hot fix files to, enter the hotfix directory and click OK, e.g. d:\hotfix
- copy the hotfix.inf file to the name of the hotfix, e.g.
copy hotfix.inf javafix.inf
You will now have a number of files in the hotfix directory, with hotfix.exe, hotfix.inf and all the versions of the .inf files you copied. You now need to merge the contents of the .inf files into one main hotfix.inf file.
If the hotfix you extracted had file tcpip.sys (ignore the .dbg files) you need to update the hotfix.inf file to include the copying of this file. Since TCPIP.SYS lives in the system32/drivers directory, you would add the line TCPIP.SYS to the [Drivers.files] section of the hotfix.inf file, e.g.
[Drivers.files]
TCPIP.SYS
You also need to add TCPIP.SYS to the [SourceDisksFiles] section, e.g.
[SourceDisksFiles]
TCPIP.SYS=1
Finally you need to add a comment at the end of the hotfix.inf file with a description of the hotfix in the [strings] section with the Q number and a comment, e.g.
[Strings]
..
HOTFIX_NUMBER="Q143478"
COMMENT="This fix corrects the port 139 OOB attack"
For multiple comments and numbers use HOTFIX_NUMBER2, COMMENT2 etc.

The reason we copied the .inf files is that you can just cut and paste the hotfix specific information to the common hotfix.inf. When you decompressed a hotfix you will see which files were created, you could then search the .inf file for the file name and it would be in two places, the directory it belongs in and the [SourceDisksFiles] section. You could then go to the bottom of the file and cut and paste the HOTFIX_NUMBER and COMMENT and add to the end of HOTFIX.INF.

This is very hard to explain and an example is probably the best way to demonstrate this. Suppose you want to install

The java hotfix - javafixi.exe
The OOB data hotfix - oobfix_i.exe
The GetAdmin hotfix - admnfixi.exe

The procedure would be as follows

Decompress the hotfixes to the hotfix directory and after each extraction backup the hotfix.inf file in the order admnfixi.exe - javafixi.exe - oobfix_i.exe
Admnfixi.exe consists of ntkrnlmp.exe and ntoskrnl.exe, search admnfixi.inf (the copy we made) for the files and they appear as follows
[Uniprocessor.Kernel.files]
NTOSKRNL.EXE

[Multiprocessor.Kernel.files]
NTOSKRNL.EXE, NTKRNLMP.EXE

[SourceDisksFiles]
NTKRNLMP.EXE=1
NTOSKRNL.EXE=1

[Strings]
HOTFIX_NUMBER="Q146965"
COMMENT="This fix corrects GETADMIN problem"
javafixi.exe consists of win32k.sys so search javafixi.inf for win32k.sys
[MustReplace.System32.files]
WIN32K.SYS

[SourceDisksFiles]
WIN32K.SYS=1

[Strings]
HOTFIX_NUMBER="Q123456"
COMMENT="This fix corrects the problem with True Color adapter cards and Java"
The current version of hotfix.inf already contains the information for the oobfix as it was the last installed, so the information for the above 2 must be added resulting in the changes being

[MustReplace.System32.files]
WIN32K.SYS

[Drivers.files]
TCPIP.SYS

[Uniprocessor.Kernel.files]
NTOSKRNL.EXE

[Multiprocessor.Kernel.files]
NTOSKRNL.EXE, NTKRNLMP.EXE

[SourceDisksFiles]
NTKRNLMP.EXE=1
NTOSKRNL.EXE=1
TCPIP.SYS=1
WIN32K.SYS=1

[Strings]
;; this part needs modifying, only one HOTFIX_NUMBER can be passed so created your own internal reference,
;; e.g. Q99999 and also the comments need a unique number at the end, e.g. comment1, comment2 otherwise
;; only the first comment will be entered
HOTFIX_NUMBER="Q999999"
COMMENT1="This fix corrects the port 139 OOB attack"
COMMENT2="This fix corrects GETADMIN problem"
COMMENT3="This fix corrects the problem with True Color adapter cards and Java"

To install just type

hotfix

from the directory created (i.e. hotfix), you will see a dialog copying the files (the ones you have specified in the hotfix.inf file :-) ), and the system will reboot. To see what hotfixes are installed:

Start the Registry Editor (Regedit.exe)
Look at the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix values

Q. How do I install Hotfixes the same time as I install Service Pack 3 onwards?

A. Update.exe that ships with Service Pack 3 checks for the existance of a hotfix subdirectory, and if in that directory the files hotfix.exe and hotfix.inf are present you are asked when running update.exe if you also want to install the hotfixes.

Create a direrectory to hold the extracted Service Pack
md servpack
Extract the Service Pack
nt4sp3_i /x
You will be asked for a directory, enter the created directory, e.g. e:\servpack and click OK
Create a hotfix subdirectory
md hotfix
Extract the hotfixes to this directory using the instructions in the previous FAQ
Run UPDATE.EXE in the servpack directory and click Yes when asked to install Hotfixes

Q. I have installed Service Pack 3, now I cannot run Java programs.

A. Download the updated Java Virtual Machine from Microsoft at http://www.microsoft.com/java/download/dl_vmsp2.htm . Download build 1518 which works with IE3.01, IE 3.02 and IE 4.0 platform preview 1, do NOT install on IE 4.0 PP2 or the release version.

There is also a hotfix for Service Pack 3 available from Microsoft ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/java-fix/JAVAFIXI.EXE

Q. I have installed Service Pack 3, however the Policy Editor has not been updated.

A. This is caused by a mistake in the Service Pack 3 update.inf file. The entry for poledit.exe (the executable for the policy editor) is specified in the [MustReplace.system32.files] section whereas the file should actually be in the [SystemRoot.files].

To install the new Policy Editor perform the following

Expand the service pack
nt4sp3_i /x
You will be asked for a directory, enter a path and click OK. A message "Extraction complete" will be displayed when completed
Move to the directory the service pack was extracted to and copy the file poledit.exe to the %systemroot% directory
copy poledit.exe %systemroot%

Alternatively you can update the update.inf fiile and move the location of poledit.exe from [MustReplace.system32.files] to [SystemRoot.files].

Q. How can I tell if I have the 128 bit version of Service Pack 3 installed?

A. The easiest way to tell this is to examine the secure channel dynamic link library (SCHANNEL.DLL):

Start Explorer (Win + E or Start - Programs - Explorer)
Move to %systemRoot%/system32 (where %systemRoot is the windows NT directory, e.g. d:\winnt)
Right click on Schannel.dll and select properties
Click the Version tab. The description will be one of the following:
PCT / SSL Security Provider (U.S. and Canada for the 128 bit version.) if you have the 128 bit version
or
PCT / SSL Security Provider (Export Version) if you have the non-128 bit version
Click OK when finished
Close Explorer

Q. How do I install a service pack during a unattended installation?

A. There are various options, however all of them require for the service pack to be extracted to a directory, using

NT4SP3_I /x

and you then enter the directory where you want to extract to.

You could extract to a directory under the $OEM$ installation directory which would then be copied locally during the installation and you could add the line

".\UPDATE.EXE -U -Z"

to CMDLINES.TXT. This will increase the time of the text portion of the installation as the contents have to be copied over the network.

With Service Pack 4 you could just add and not need to expand the service pack first.

[Commands] ".\sp4\sp4i386.exe -z -u"

Simply create a folder called sp4 under $OEM$ and copy sp4i386.exe to it.

If using the above you should ensure you have the following in unattended.txt

[Unattended] OemPreinstall=yes

An alternate method is to install from a network drive, this requires a bit more work:

Create a directory on a network server and copy the extracted service pack to this directory. Setup a share on this directory called SP
Create a batch file in the $OEM$ share of the installation area called SERVPACK.CMD with the following:
net use z:\\<server>\SP /persistent:no /user:<domain name> \guest < password.txt
z:\update.exe -u -z
You need to create the password.txt file that contains the guest account password (usually blank) therefore perform the following:
- type copy con password.txt
- press ENTER once
- press CTRL+Z to save the file
If the password is not blank enter the password then press ENTER
Copy the password.txt file to the $OEM$ directory
Edit CMDLINES.TXT and add ".\SERVPACK.CMD" to the end

Q. What order should I apply the Hot fixes?

A. There is no specific order to apply post Service Pack 4 and Service Pack 5 hotfixes.

The Service Pack 3 hotfixes are, for the most part, cumulative. This means that the latest binary also includes fixes previously made to the same binary.

For example, the 01/09/98 version of Tcpip.sys (teardrop2-fix) also includes previous fixes to Tcpip.sys (such as land-fix, icmp-fix, and oob-fix).

When you apply multiple fixes, please install them in the following order to ensure a newer fix is not replaced by an older one.

oob-fix
asp-fix
java-fix
dns-fix
iis-fix
lsa-fix
dblclick-fix
icmp-fix
zip-fix
roll-up (or roll-up/cluster)
mdl-fix
getadmin-fix
roll-up/cluster
winsupd-fix
ndis-fix
scsi-fix
2gcrash
simptcp-fix
ide-fix
wan-fix
land-fix
pent-fix (x86 only)
joystick-fix (x86 only)
SAG-fix
iis4-fix
pptp-fix
teardrop2-fix
tapi21-fix
pcm-fix
srv-fix
y2k-fix
euro-fix
atapi-fix
netbt-fix
prnt-fix
sfm-fix
pptp2-fix
rras20-fix
lsa2-fix
ssl-fix
priv-fix
pptp3-fix
rras30-fix

For the Microsoft version of the list please see ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/postsp3.txt

Q. I get an error message when I try to re-apply a hotfix after installing a service pack?

A. If when you try and reinstall a hotfix (after re-applying a service pack etc.) you get the error

Hotfix: The fix is already installed. Hotfix: Internal consistency error: Invalid Tree pointer = <garbage characters displayed>.

you need to remove the hotfix before trying to reinstall.

To remove a hotfix you would usually use hotfix /r or hotfix -y (depending on the version, to check how use /? on the hotfix for the syntax) however there are situations where it will refuse to remove the hotfix:

Hotfix: Fix <name of hotfix> was not removed.

All the hotfix actually does when you install one is to check a registry entry so see if it already there, so to get round this problem we can go into the registry and remove the hotfixes corresponding entry.

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix
Under this key will be a number of sub-keys with name of the Knowledge base article the hotfix is referenced by as the name, e.g. Q123456 (the True Colour adapter fix).
To get more details about the hotfix, select the key (e.g. Q123456) and look at the "Fix Description" value.
To remove NT's knowledge of the fix being installed select the specific hotfix you want to remove (e.g. Q123456) and select Delete from the Edit menu. Click Yes to the confirmation
Close the registry editor.

The fix is still installed on the system, all you have done is removed NT's knowledge of its installation so you will now be able to re-install the hotfix in the normal way.

Q. When will Service Pack 4 be released and what's in it?

A. Service Pack 4 has now been released.

The contents of Service Pack 4 are here in the readme.txt file.

An extra file, Y2K, is available which is around 70MB and this contains updates to other components to make them Year 2000 compliant such as IE 4.0 Service Pack 1.

Bugs fixed in Service Pack 4 are as follows:

Service Pack 4

 Q109993 Winsock Application Causes 0x0000000A Blue Screen STOP Message
 Q112547 Dial-Up Networking Hangs After Failed Multilink Attempt
 Q123597 WinNT Err Msg: Error 614 Out of Buffers When Using RAS Script
 Q125020 NetBIOS SEND WAIT Call Returns Before RECEIVE is Sent
 Q129047 Synchronizing DNS Information in Registry with Boot Files
 Q129457 Anonymous Connections May Be Able to Obtain the Password Policy
 Q137565 System Error 53 When Connecting to a FQDN
 Q138791 SCSI Printing Devices Requiring Wide SCSI May Fail
 Q141496 DHCP Client Comment Disappears When Obtaining IP Address
 Q141708 Printing to LPD Printer Is Slow or Fails with Windows NT
 Q142026 Err: "Hidden Console of WOW VDM" Running 16-bit or MS-DOS App
 Q142047 Bad Network Packet May Cause Access Violation (AV) on DNS Server
 Q142615 Event Log Service Fails to Check Access to Security Log File
 Q142635 Cannot Change the Drive Letter of Removable Drives
 Q143160 Enterprise Server Stops During Print Spooling
 Q143478 Stop 0A in Tcpip.sys When Receiving Out Of Band (OOB) Data
 Q143484 IIS Services Stop with Large Client Requests
 Q146095 STOP: 0x0000000A or STOP: 0x0000001E in Tcpip.sys
 Q146965 GetAdmin Utility Grants Users Administrative Rights
 Q147222 Group of Hotfixes for Exchange 5.5 and IIS 4.0
 Q147706 How to Disable LM Authentication on Windows NT
 Q149658 TCP/IP Printing Causes File Cache to Grow
 Q150953 Nwuser.exe Send Function Truncates Messages to 38 Characters
 Q151677 NWLink SPX Ignores Allocation Number Sent By Peer
 Q151778 Huge Downlevel Print Job Causes File Cache to Grow
 Q151860 STOP 0x0A While Writing to the Middle of a Cached File
 Q152079 SNMP Traps Contain Invalid Agent ID Field
 Q152764 Garbled Characters Appear in Windows NT Print Queue
 Q152993 Raster Fonts Print Different on Windows NT 4.0 Than on 3.51
 Q153161 WinNT Systems Running RAS May Exhaust Available DHCP Leases
 Q153296 Write Cache on IDE/ATAPI Disks Is Not Flushed on Shut Down
 Q154087 Access Violation in LSASS.EXE Due to Incorrect Buffer Size
 Q154094 Using Iomega ATAPI Zip Drives with Windows NT
 Q154162 Memory Leak in Perfmon.exe Occurs Monitoring WINS Counters
 Q154174 Invalid ICMP Datagram Fragments Hang Windows NT, Windows 95
 Q154387 TAPISRV.EXE Thread Uses Excessive CPU Time
 Q154398 BDC Secure Channel May Fail if More Than 250 Computer Accounts
 Q154460 Denial of Service Attack Against WinNT Simple TCP/IP Services
 Q154475 Add Printer Wizard Printer Browse List Not in Alphabetical Order
 Q154552 NETSTAT Causes Memory Leak
 Q154694 New Policy Available to Hide Go To on Tools Menu
 Q154791 MS-DOS-based Applications May Not Find All Files
 Q154984 DNS Server May Not Recursively Resolve Some Names
 Q154985 DNS Registry Key Not Updated When Changing Zone Type
 Q154990 SETPASS May Change Password of Wrong User
 Q155495 Reference Counter Overflow in Security Descriptor Causes STOP
 Q155701 Invalid UDP Frames May Cause WINS to Terminate
 Q156655 Memory Leak and STOP Screens Using Intermediate NDIS Drivers
 Q157032 Services for Macintosh May Cause STOP 0x0A During High Load
 Q157123 Communicating with SNA Hosts May Cause STOP 0x0A in DLC.SYS
 Q157182 FPNW Causes STOP 0x50 When Connection Is Closed Twice
 Q157911 Deadlock in Service Control Manager During System Shut Down
 Q157913 Services Set to Interact With Desktop May Fail to Start
 Q158396 Explorer Hangs When Creating a New Folder On a MAC Volume
 Q158516 Access Violation in RPCRT4.DLL When Pickling Buffered RPC Data
 Q158548 Sysdiff Changes Dates on Files It Applies to Windows NT
 Q158581 Icon Position Not Stored When Using Roaming Profiles
 Q158682 Shortcuts Created Under Windows NT 4.0 Resolve to UNC Paths
 Q158706 Netmon Performance Counters Support a Maximum of Eight Adapters
 Q159310 Updated Version of Dns.exe Fixes Several Problems
 Q159595 Missing Uppercase "A" Character in the 1257 Font
 Q159599 WINS Consistency Checking May Not Start at Scheduled Time
 Q159839 Sysdiff Does Not Add Empty Directories
 Q159909 STOP 0x0000000A May Occur on Multiprocessor Systems
 Q160517 RRAS May Decrement Local Static Route Metric
 Q161968 NetBT Tears Down TCP Session with Many Concurrent File Transfers
 Q161969 LPR Printing Device Reports an Error If Printer Not Available
 Q162230 Fragmentation and Performance Issues with PPTP Connections
 Q163055 DHCP Client May Fail with WinNT 4.0 SP2 Multinetted DHCP Server
 Q163251 STOP 0xA Due to Buffer Overflow in NDISWAN.SYS
 Q163662 Running Multiple Instances of an Application Causes STOP x50
 Q163852 Invalid Operand with Locked CMPXCHG8B Instruction
 Q163855 STOP 0x0000001e May Occur in Srv.sys w/ Down Level Client
 Q164023 Fix for Gethostbyname() IP Address Order on Local Multihomed Mac
 Q164253 WinNT Err. Msg: Event ID 2018 When Srv.sys Is out of Memory
 Q164314 WinNT Err Msg: STOP 0x0000001E in Win32k.sys When Moving Mouse
 Q164438 FPNW Print Jobs Do Not Print or Errors Occur in FPNW Interface
 Q165005 Windows NT Slows Down Because of Land Attack
 Q165181 EISA Configuration Boot Code Is Replaced on Mirror Drives
 Q165387 Sharing Violation When Deleting a Folder
 Q165404 NTVDM AV on Servers with Exchange cc:Mail Connector
 Q165439 Parsing LMHOSTS with Invalid Entries Can Cause Stop 0x1E
 Q165664 RPC Encoding API "MesInqProcEncodingId" May Not Work
 Q165989 GetPeerName() Returns WSAENOTCONN After Select() Returns Success
 Q166571 Creating an SFM Volume on Large Partition Causes a Stop 0x24
 Q166822 Remote Password Change Works Incorrectly to Down-Level Server
 Q166846 Cannot Reconnect to TN3270 Server with Close Listen Sockets
 Q167038 RAS Clients Run Winsock and RPC Applications Slowly
 Q167040 PPTP Performance Update for Windows NT 4.0 Release Notes
 Q167110 WinNT Err. Msg: Stop 0x1E in FPNWSRV.SYS
 Q167395 RIP Routes May Expire Early When Running Windows NT 4.0 RIP
 Q167629 Predictable Query IDs Pose Security Risks for DNS Servers
 Q167703 Canon Bubble Jet BJC-4300 Does Not Support Ledger Paper
 Q167708 BootP Client Names Disappear in DHCP Manager
 Q167871 Error When Connecting to a Share on WinNT 4.0 NTFS Partition
 Q167969 Under Windows NT, Win16 Applications Opening MS-DOS Devices Fail
 Q168076 WINS Fails to Converge
 Q168662 DLC May Fail When Connecting Through an IBM 2210 Router
 Q168748 Java Applets Cause IE 3.02 to Stop Responding w/ SP3
 Q169020 32-bit Help Fails to Start When 16-bit Help Is Running
 Q169131 Print Setup Dialog Box May Take a Long Time to Display
 Q169274 TCP/IP Causes Time Wait States to Exceed Four Minutes
 Q169291 Using Scopes with Different Subnet Masks in a Superscope
 Q169404 NTFS Directory Corruption with Frequent File Creation
 Q169461 Access Violation in DNS.EXE Caused by Malicious Telnet Attack
 Q169608 Occasional File Corruption When Using Unbuffered I/O
 Q169822 DSMN RAS Dial-in Properties Deletes NetWare Compatibility
 Q169839 XFOR: Cannot Enable (Appletalk) MTA Service NT SP3
 Q169847 SNMP SysUpTime Counter Resets After 49.7 Days
 Q169888 User-Define Path Dropped When User and System Paths Too Large
 Q170057 Dr. Watson Dialog Box Stops Responding
 Q170509 Memory Leak in SERVICES.EXE Causes Performance Degradation
 Q170510 Double-Clicking the Mouse Button Acts as a Single Click
 Q170517 Cannot Log on Using IPX After Installing SP3 on Windows NT 4.0
 Q170518 DNS Admin Fails When Managing Large Number of Zones
 Q170534 Microsoft FTP Client Echoes Gateway Password on the Screen
 Q170566 Ntbackup.exe Log Has Additional Space at Beginning of Each Line
 Q170568 Seagate Tape Drive Light Stays Lit After Exiting NTBACKUP
 Q170572 Unable to Format a 1.44-MB Disk on an LS-120 After SP3
 Q170626 DDEML: Memory Leak in Global Shared Memory
 Q170753 Window Focus Set to Invoke Wrong 16-bit Application Through DDE
 Q170817 Windows NT Causes APC Smart UPS Battery to Discharge
 Q170880 Diskdump.sys Common Buffer Size Is Changed
 Q170965 SFM Time and Date Stamp Change Copying Between Volumes Locally
 Q171180 Non-Paged Pool Memory Leak in IRP Pool Tag
 Q171181 Deadlock in TCP/IP on Multiprocessor Computers
 Q171213 Copy to Removable Drive in Explorer May Fail After Media Swap
 Q171295 Fault Tolerant Systems May Encounter Problems with WinNT SP3
 Q171307 How to Disable SAP Broadcast for RPC Service
 Q171308 Explorer File Properties Dialog Version Tab Missing
 Q171386 Connectivity Delay with Multiple Redirectors Installed
 Q171458 Windows NT May Fail On Request to Open Large Files
 Q171564 TCP/IP Dead Gateway Detection Algorithm Updated for Windows NT
 Q171790 Time Incorrect After Restarting Multiprocessor System
 Q171940 MS-DOS Application I/O Operations Cause Floppy Drive Access
 Q171989 Windows NT Services for Macintosh May Not Start in Desired Zone
 Q171996 Winsock Function Calls Generate Non-Paged Pool Memory Leak
 Q171997 WINS Replication Does Not Start As Scheduled
 Q172003 Macintosh Change Password Fails on Down Trusted Domain PDC
 Q172030 WinNT Err Msg: Stop 0xA in TCPIP.SYS
 Q172122 Toshiba I586 Pro 230 MHz System and the National 307 Chip
 Q172147 Add Printer Wizard Hangs When Searching for Remote Printers
 Q172290 Routing and Remote Access "Out of Buffers" Event Logs
 Q172511 Stop 0x0000000A w/ Services for Macintosh & McAfee Anti-Virus
 Q172512 Routing and Remote Access Event ID 20100
 Q172613 Errors Connecting Through RAS When Password Expires
 Q172705 Explorer Access Violates When Viewing a File's Properties
 Q172762 Continuous Bhnt.sys Load and Unload Causes STOP 0xA and 0x7F
 Q172885 NetWare Print Server Names With Periods Truncated in Explorer
 Q172930 Removing Bypass Traverse Checking Causes Copy to Drop Streams
 Q172982 16-bit ShellExecute Fails if Application Exists in Long Path
 Q173059 Security Events Are Not Logged During Audit
 Q173277 No Memory.dmp File Created with RAM Above 1.7 GB
 Q173322 How to Disable Autochk During a Windows NT Reboot
 Q173385 System Policy Editor Will Not Allow More Than 255 Characters
 Q173523 IIS 3.0 Can Fail in Low Memory Conditions
 Q173525 WINS Client May Switch Primary and Secondary WINS Servers
 Q173526 "Serious Disk Error" When Saving Word 6.0 Document on Windows NT
 Q173533 WinNT Radius Client Sends Incomplete Accounting Information
 Q173676 Client Cannot Resolve MX Record via Microsoft DNS Server
 Q173753 Duplicate IP Addresses After Upgrading DHCP Clients to SP2
 Q173817 Savedump.exe Now Provides More Security to Memory.dmp
 Q173881 STOP 0x0000000A in Netbt.sys on a Multiprocessor Computer
 Q173941 Windows NT DNR Does Not Cache Short Names
 Q173993 Dialog Message Not Sent Correctly from 32-bit to 16-bit App
 Q173994 GetTextExtentPoint32W May Fail with Unicode Characters > 0x
 Q173997 Drive Letter Not Displayed in Error Message Box
 Q173998 Middle East/Thai Windows NT May Print Incorrect Characters
 Q174020 STOP 0x0000001E During Forced Shutdown and Program Exit
 Q174058 Delayed Worker Threads Causes a STOP 7A
 Q174076 Invalid Password Message When Strong Passwords Are Required
 Q174187 WinNT Does Not Display IBM PS/2 TrackPoint as the Mouse Driver
 Q174205 LSASS May Use a Large Amount of Memory on a Domain Controller
 Q174233 KeInitSystem Function Returns Uninitialized Stack on Alpha
 Q174234 Computer Hangs with Intensive 16-bit Code Running in a VDM
 Q174266 "Print Screen" from MS-DOS Application May Print Twice
 Q174333 Installing Win95 Print Drivers on WinNT 4.0 Asks for Wrong Disk
 Q174465 Bad SAP Packet Causes 0x0000000A In Afd.sys
 Q174478 Minimizing or Maximizing Does Not Redraw Window Properly
 Q174502 Fault Tolerant Recovery Does Not Reoccur After Shut Down
 Q174509 Stop 0x0000000A in Ndiswan.sys with Digiboard ISDN Board
 Q174510 Print Job Corruption Printing on Fast Hardware Across Slow Link
 Q174531 DirectDraw Fails Surface Creation with Large Dimensions
 Q174534 BitBlt May Not Work When Raster Operation Mode Is NOTSRCCOPY
 Q174535 Access Violation When TCMAPP Exceeds 16 Users
 Q174540 Extra Page Printed on Epson Stylus Color Printers
 Q174541 Publisher 3.0/4.0 Does Not Print Brick or Vertical Line Patterns
 Q174543 Enabling the Shift Lock Feature on Windows NT 4.0
 Q174555 STOP 0x0000001E When IIS Service Is Stopped
 Q174625 Environment Variables May Prevent Logging On
 Q174676 NetWare Authentication Failure When Logging On to NetWare Server
 Q174748 XADM: ESEUTIL /g Returns Error -1022
 Q174764 Memory Leak in Ntfs.sys
 Q174830 NMI Error Message on Blue Screen May Be Garbled
 Q174840 Disabling Buttons in the Windows NT Security Dialog Box
 Q174844 Spooler Service Causing Access Violation
 Q174869 WINS Client Sends Refresh Requests to Secondary WINS Server
 Q174871 Printer Shares Lost after Changing Server Name
 Q174927 Error Message During Setup of Noncritical Changes
 Q174929 No Response to ARP Causes Duplicate IP Addresses on Network
 Q174932 STOP 0x0000000A with Halmps.dll When Restarting
 Q175035 Diskless Workstations Cannot Find BOOTP Server with DHCP
 Q175048 CACLS Quits on Access Denied Errors with /c
 Q175093 User Manager Does Not Recognize February 2000 As a Leap Year
 Q175225 Disabling Context Menus Does Not Disable Key Combinations
 Q175266 Creating Many Partitions Causes Double Drive Letters
 Q175321 SNA Client Sessions Hang Until SNA Server Is Restarted
 Q175468 Effects of Machine Account Replication on a Domain
 Q175637 Poor Print Quality with Epson Stylus Pro XL ESC/P 2
 Q175641 LMCompatibilityLevel and Its Effects
 Q175643 CR Interpreted As CR/LF When Text Job Is Converted to PCL or PS
 Q175667 Error Message: Copy Profile Error
 Q175687 Win32k.sys Causes STOP 0x0000001e and 0x0000000a On SMP
 Q175738 Collate Feature May Not Work with PostScript Printing
 Q175745 Memory Leak When Using Win32 GetClipboardFormat API
 Q175877 CSNW Connection Leak When Running 16-bit Applications
 Q176081 Access Violation in Explorer.exe Removing a Share
 Q176082 RRAS Server Updates Link State Database but Not Route Table
 Q176087 LPRMON Status Strings Are No Longer Localized on German Version
 Q176209 RAS or RRAS Server Fails to Answer Incoming Calls
 Q176211 Console-mode Apps May Run Slowly on Multiprocessor Computers
 Q176319 Docfile Standard Marshalling Returns 0x800706f4
 Q176322 The Far East GetTextExtent API Fails with Null LPNFit
 Q176502 RAS Authentication Rechallenge Resets Compression Flag
 Q176922 Multiple IP Addresses Cause Dynamic Packet Filter to Fail
 Q176973 Stop 0x0000000A in Netbt.sys on BDC When WINS Server Shuts Down
 Q176976 Wrong Return Value from MkParseDisplayName
 Q176977 STOP 0x00000023 FAT_FILE_SYSTEM with Corrupted Floppy Disk
 Q177113 Incomplete Print Jobs Using JetDirect over SPX
 Q177125 User Cannot Log On to LAN Because of RAS Logon Failures
 Q177154 Access Control Causes Reverse Proxy to Fail
 Q177245 Multiprocessor Computer May Hang Because of Tcpip.sys
 Q177257 STOP 0x0000000A or Difficulty Recognizing IDE CD-ROM Drives
 Q177445 Use LoadLibraryEx When Loading Printer Drivers
 Q177471 EBCDIC Characters not Properly Converted to ANSI Characters
 Q177591 Service Pack Version Truncated in About Box
 Q177631 Comdlg32 Fails to Display Drives Mapped by SUBST Command
 Q177644 Commenting Macintosh File Changes Date and Time Stamp
 Q177647 Nonpaged Pool Size Incorrectly Displayed in Performance Monitor
 Q177650 Remote Shutdown Fails If User Is Logged On Without Rights
 Q177651 AT Command Handles Quotation Marks Differently
 Q177653 CRT Conflict with Getservbyname
 Q177654 Slow Network Performance Using NetBEUI Across Bridges
 Q177655 Negative Values in Performance Monitor Data
 Q177660 Access Violation Occurs in Sfmprint.exe on Busy Print Server
 Q177668 Calibration Does Not Change When You Calibrate Foot Pedals
 Q177670 RRAS Does Not Enforce Strong Encryption for DUN Clients
 Q177676 Stop 0x00000024 May Occur When Bypass Traverse Checking Disabled
 Q177677 TSR Applications Hang While Login.exe Is Running
 Q177680 With GSNW, WinNT Client Cannot See All Files on NetWare Server
 Q177684 Application Using SetOwner May Hang Windows NT User Interface
 Q177757 Dr. Watson Does Not Report Service Pack Number
 Q177868 SnmpMgrTrapListen API Returns ERROR_SERVICE_NOT_ACTIVE Error
 Q177906 Caching Does Not Work Under Reverse Proxying
 Q177983 Stop 0xA in Netbt.sys with Greater Than 64 Adapters
 Q178109 Roving Profiles for Windows 95 Clients Stop Working
 Q178110 FPNW Does Not Allow OS/2 Clients to Open Files
 Q178113 Specifying a Group Name in LMHOSTS File May Cause STOP 0xA
 Q178202 Fix for Loss of Data Records or Partial Records Written to Disk
 Q178205 Connecting to a Server is Slow over RAS Using LMHOSTS File
 Q178208 CrashOnAuditFail with Logon/Logoff Auditing Causes Blue Screen
 Q178302 XADM: Upgrade to Exchange 5.5 Fails If Virus Software Is Enabled
 Q178364 Macintosh Clients See Files on WinNT Server Constantly Moving
 Q178381 SNMP Leaks Memory If the OID Cannot Be Decoded
 Q178393 SQL Server Hangs When Sending a Message Using SQLMail
 Q178413 Windows NT System May Hang When Running a Filter Driver
 Q178414 Archive Bit Is Not Reset When a File Is Renamed
 Q178471 STOP 0XA Caused by Race Condition in VDM and Process Delete
 Q178546 CSNW Does Not Display Directory Name with Extended Characters
 Q178550 IP Address Conflict with Address 0.0.0.0
 Q178557 Dr. Watson May Display Message Box Even When Disabled
 Q178636 Directory Listing Not Correct When Using Russian Characters
 Q178723 Problems with "Run Only Allowed Windows Application"
 Q178741 Event Log Opening Problem Causes Services.exe Failure
 Q179092 NWLNKIPX Sends Broadcast RIPX Packets Over the Network
 Q179107 STOP 0x0000000A in Raspptpe.sys on a Windows NT PPTP Server
 Q179129 STOP 0x0000000A or 0x00000019 Due to Modified Teardrop Attack
 Q179147 Access Denied Starting Program
 Q179156 Updated TCP/IP Printing Options for Windows NT 4.0 SP3 and Later
 Q179157 Stop 0xA in Tcpip.sys When Source Routing Data Exceeds 18 Bytes
 Q179187 Problems Using TAPI 2.1
 Q179190 NWRDR May Send Excessive GetNearestServer Requests
 Q179433 Cache Manager May Cause Data Corruption on SMB Servers on FAT
 Q179553 Access Violation in PolEdit When Defining Allowed Windows Apps
 Q179741 STOP 0x0A Due to Duplicate Free in Afd.sys
 Q179827 Registry Handle Leak Causes Random Blue Screens
 Q179873 Files Open with UNC Path May Be Closed Prematurely
 Q179983 RDR Sessions on UNC Name Images May Log Off Prematurely
 Q179995 Memory Leak in FPNW Causes Windows NT Server to Hang
 Q180168 Novell Client 32 for Win95 Displays Duplicate Files on FPNW
 Q180356 NWConv Fails to Apply Correct Group Permissions
 Q180532 Xircom PC Card Fails to Function
 Q180622 STOP:0x0000001E with STATUS_INSUFFICIENT_RESOURCES in Sfmsrv.sys
 Q180648 Windows NT 4.0 Traps with a Stop 0x24 or Stop 0xA
 Q180716 SFM Fails to Accept Associations with Two-Character Extensions
 Q180717 SFM: File Date and Time Stamp Change with Get Info
 Q180718 SFM: Disconnect Macintosh Clients before Dismounting Volume
 Q180854 Access Violation in Winlogon with Third-Party Gina.dll
 Q180875 Russian Clients May Have File I/O Problems on an FPNW Server
 Q180963 Denial of Service Attack Causes Windows NT Systems to Restart
 Q181022 Err: Cannot Write to LPTx Printing to Parallel Port
 Q181120 Manual Dial Dialog Fails to Appear when Logging On
 Q181311 Data Corruption Occurs with Record Locking on FPNW Server
 Q181799 RPC/TCP Connection Attempt Made Only to First Address
 Q181859 Stop 0x0000000A When Using UltraBac to Back Up a SQL Server
 Q181928 Using POLEDIT to Save Policy Files on NetWare Servers May Fail
 Q182005 Euro Currency Not Available in Windows NT Character Sets
 Q182047 DHCP Server Performance Degraded by Large Number of Scopes
 Q182205 Clients Cannot Send Mail Attachments Through Modem Sharing
 Q182227 DNS Server Does Not Check for Delegations Before Forwarding
 Q182288 RPC May Cause System to Stop Responding during Shutdown
 Q182322 SNMP Appends Garbage to Data in Response to SNMP Get
 Q182333 Excessive Processor Usage on Print Servers
 Q182441 Full Synchronization from WinNT PDC to LanMan Server May Fail
 Q182444 NBF MaxFrameSize Calculated Incorrectly on Token Ring
 Q182540 WinNT x86 MPS HAL Can Fail To Map System Relative IRQs
 Q182644 DNR Sorts IP Address for Multihomed Hosts Before Returning List
 Q182781 Client Connections to Multihomed Server Not Load Balanced
 Q182816 WINS PriorityClassHigh Parameter Does Not Work After Restarting
 Q182817 CSNW: Unable to Rename File on NetWare Server
 Q182825 NET USE Returns Error 53 When Host Has 3 or more NICs
 Q182918 Account Lockout Event also Stored in Security Event Log on DC
 Q183054 Taking Ownership Remotely May Set Owner Incorrectly
 Q183069 Ensoniq PCI Sound Card Experiences Static When Disk Is Accessed
 Q183123 Find Files Displays Garbled Date if Year is 2000 or Greater
 Q183125 Shell Doc Property Dialog Custom Date Incorrect after Year 2000
 Q183283 IE Through Proxy Server to IIS May Stop on Page with Scripts
 Q183292 Print Preview Frequently Causes Access Violation in Spooler
 Q183335 Calling Card and Area Code Not Dialed Using Both TAPI Options
 Q183419 Memory Leak in Spoolss.exe Causes Performance Degradation
 Q183581 Out of Virtual Memory Messages During Windows NT Installation
 Q183651 Default Memory Settings for Lexmark Optra S 1250 Incorrect
 Q183652 Access Violation When More Than 200 Adapters Are Installed
 Q183653 Client Authentication Fails Connecting to Netscape Server
 Q183654 IBM DTTA-351010 10.1 GB Drive Capacity Is Inaccurate
 Q183656 XCOPY Returns "Invalid Parameter" When Using Date Switch
 Q183657 Unable to Insert OLE Objects into Application Documents
 Q183664 NDS Logon Scripts Do Not Execute Correctly
 Q183676 Window Position of Windisk.exe Causes Access Violation
 Q183677 Client Authentication with Personal Certificates Fail
 Q183699 Winsdmp.exe Inefficiently Dumps WINS Databases with Large ID
 Q183704 Hide Drives Policy in Common.adm Has No VALUEOFF Statement
 Q183705 RPC Mishandles Changes in the Number of IP Addresses
 Q183709 Printing from Xerox 3006 May Cause Paper Jams
 Q183718 CACLS Not Resolving Principle Names Correctly
 Q183749 Access Violation in INETINFO:TerminateExtension
 Q183755 More Than One Internal IP with Socks Enabled Causes Dr. Watson
 Q183812 Problems When a Connection over an ISDN Bridge Is Not Closed
 Q183819 DCOM over HTTP Method Calls May Hang for up to 15 Minutes
 Q183832 GetHostName() Must Support Alternate Computer Names
 Q183840 Stop 0xC000021A When Starting Task Manager with CTRL+ALT+DEL
 Q183859 Integrity Checking on Secure Channels with Domain Controllers
 Q183875 DHCP Server Leases Excluded Addresses if the Scope Is Expanded
 Q183886 Access Violation in LSASS When Logging on System
 Q183930 FIX: IP Is Mangled When Using UDP on Multihomed Computers
 Q184017 Administrators Can Display Contents of Service Account Passwords
 Q184026 NetDDE Causes Dr. Watson When Closing Incomplete Connections
 Q184072 HasOverlappedIoCompleted, GetOverlappedResult Give Wrong Value
 Q184101 Small Single and Double-Precision Values Are Rounded to Zero
 Q184132 Err Msg: Value Entered Does Not Match with the Specified Type
 Q184139 Stopping RPC Locator Service Causes Error 2186
 Q184213 SystemFileCacheInformation Can Be Changed Without Privilege
 Q184219 Access Violation in Microsoft TAPI Browser 2.0
 Q184228 Dr. Watson in Nwssvc.exe Deleting Queue and Printer from FPNW
 Q184229 Copying Files to a Macintosh Volume Changes Date and Time Stamp
 Q184232 DCOMCNFG Saves Incorrect Display Name in Services
 Q184278 Server in One Domain May Disconnect Client in Another Domain
 Q184288 GP Fault May Occur with IIS on Multi-processor System
 Q184344 Reconcile on DHCP Scope Does Not Work Correctly for BOOTP Client
 Q184350 WordPerfect Suite 6.0 Setup Fails with Multiple CD-ROMs
 Q184353 DHCP ALT+H Shortcut Key for HELP Is Not Available
 Q184414 Access Violation When Printing PostScript to SFM Print Server
 Q184537 Very Large Files Cause Performance Problems
 Q184538 Error Message: A Controller for This Domain Could Not Be Found
 Q184744 DHCP Server Leaks Registry Quota on Alpha Version of Windows NT
 Q184752 Xerox PCL Does Not Print Landscape
 Q184754 Several Threads Created in LRPC Running Stress Test in IIS
 Q184758 STOP 0x78 When NonPagedPoolSize > 7/8 of Physical Memory
 Q184794 STOP 0x50 May Be Caused by PPTP Registry Entries
 Q184832 Intermittent Name Conflicts with WINS Server
 Q184835 Explorer on Windows 95 DFS Client May Hang
 Q184836 Application Access Violates When Session Is Terminated
 Q184875 API Function BroadcastSystemMessage() Always Returns 1 (Success)
 Q184879 Windows NT Logon Dialog May Disappear
 Q184881 Reverse Lookups with BIND Earlier Than 4.8.3 Fail
 Q184891 Server.HTMLEncode Garbles Extended Characters
 Q184937 Session Between Multihomed Computers May End Unexpectedly
 Q184954 Computer Hangs While Booting with HP 6L Printer out of Paper
 Q184996 Incomplete List of NetWare Server Volumes with CSNW/GSNW
 Q184998 RDR May Read or Write from Wrong File If File Is Memory Mapped
 Q185051 Restarting Cluster Service Causes Services.exe to Crash
 Q185081 No Domain Controllers Found When Logging on Using RAS
 Q185137 Log Logical Record Request May Be Sent to Wrong Server
 Q185142 NetWare API Log Logical Record May Incorrectly Succeed
 Q185203 SPOOLSS Hangs When Printing a File With a Corrupted EMF Record
 Q185212 Cluster Server Does Not Support More than 900 Shares
 Q185219 IIS 4.0 with Multiple Certificates May Return Error
 Q185260 User Accounts May Get Locked out After Entering Wrong Password
 Q185300 STOP 0x24 in Ntfs.sys Function NTFSMoveFile()
 Q185323 Pool NonPaged Bytes Not Accurately Calculated for User Mode
 Q185349 Problems Remotely Accessing W3 or FTP Perfmon Counters
 Q185355 Printers Folder Displays Printer Error When Printer Is Busy
 Q185559 Negative Value in NtGdiFastPolyPolyline Causes Blue Screen
 Q185568 WlxCloseUserDesktop Function Unavailable for GINA Writers
 Q185571 Printing from Lotus Freelance 97 Produces Thin Horizontal Line
 Q185605 Stop Error Caused by Invalid Use of Private Video Driver Handle
 Q185624 Calls to NtQueryVolumeInformationFile May Cause Stop 0x0000001E
 Q185625 Windows NT Client Logon Fails with EnableSecuritySignature Set
 Q185668 IntelliMouse TrackBall Wheel Does Not Work with Service Pack 3
 Q185682 Bugcheck When IPX Is Bound to Only Ndiswan Adapter
 Q185722 SFM Rebuilds Indexes upon Restarting of Windows NT
 Q185723 Explorer File Copy from Windows 95 Share Fails
 Q185727 BUG: closesocket() Fails with 10038 After _open_osfhandle()
 Q185729 Computer Becomes Unresponsive During CGI Stress Test
 Q185734 DNS Server Access Violation in Dns!sendNbstatResponse Routine
 Q185735 Explorer Crashes When Dragging Lotus Notes Files over Toolbar
 Q185736 Applications May Appear Hung or Unresponsive on Windows NT 4.0
 Q185765 HP LaserJet 4Si Driver Unprintable Region is Incorrect
 Q185773 NTFS Corruption on Drives > 4 GB Using ExtendOEMPartition
 Q185787 STOP 0x0000002E on Alpha with ISA Sound Card
 Q185788 Windows NT Hangs on Boot on DEC Alpha Clustered Servers
 Q185791 STOP on DEC Miata and Rawhide Platforms Using Graphics Tablet
 Q185867 STOP 0x0000000A in Win32k.sys After Installing Korean Office 97
 Q185870 IIS: SQL Server Insert Error Regarding Column Name Mismatch
 Q185892 Unwanted Popup Message While Printing to an LPR Printer
 Q185944 Stop 0x7B After Installing Windows NT on an ALR Evolution-V ST
 Q185945 Access violation in win32k!HMMarkObjectDestroy in JPN and KOR NT
 Q186051 Archive Bit Is Not Set with File or Directory Rename
 Q186078 Name Resolution May Fail If NetBios Name Has ASCII Character
 Q186081 STOP 0x0000000A When Restoring Tape
 Q186101 FTP Client Does Not Show the Correct Transfer Size for Files
 Q186150 NetBEUI May Hang When Using Arcnet Under Heavy Network Traffic
 Q186158 Blue Screen When Shutting Down with RAS Connection Established
 Q186217 3C509 Is Not Autodetected During Setup on ThinkPad 760EL & XL
 Q186241 Dr. Watson May Cause CPU Usage to Spike
 Q186247 Users Are Unable to Print to Server
 Q186339 Adobe ATM 4.1 OpenType Fonts Not Showing up in Font Menu
 Q186357 RPC UseWinsockForIP is Only Applicable to UDP and IPX
 Q186416 System Hang Results from Large Number of Notify Syncs
 Q186434 Slow Network Default Profile Operation
 Q186439 Removing Server Service Results in Memory Leak
 Q186455 Mgmtapi.dll Opens Trap Socket in Exclusive Mode
 Q186463 Windows NT Replies to Address Mask Requests
 Q186473 You Can Delete All Records on a WINS Server Using SNMP
 Q186494 Event ID 517 Not Created When Security Log Is Cleared
 Q186495 WOW Leak Launching Many Instances of a 16-Bit Application
 Q186669 FPNW Logout.exe Incorrectly Reports Year After Jan. 1, 2000
 Q186743 International Characters Print Incorrectly in Schedule Plus
 Q186746 International Calling Codes Updated in Service Pack 4
 Q186770 Windows NT Hangs Trying to Access SuperDisk SLS-120 Disk Drive
 Q186805 Intermittent Stop 0xA in Srv.sys on Shutdown
 Q186820 DNS Server Returns Wrong Response When WINS Lookup Is Enabled
 Q186860 Update Memory Settings and Add Exec Paper Size to Sharp Models
 Q186873 Netbios Delays Sending/Receiving Packets When Session Is Lost
 Q186904 MPROUTER Access Violation on Invalid Radius Response
 Q186905 Radius Client Uses 100 Percent CPU on Invalid Response
 Q186929 LowercaseFiles Registry Key Has Added Functionality
 Q186963 Incorrect Dimensions in Executive Form with Mannesmann Driver
 Q187277 The FTP PORT Command Fails in IIS 3.0
 Q187302 Stop 0x00000040 in NetBT Protocol
 Q187392 PATCH: Stop 0x0000000A in Wind32k.sys xxxDDETrackWindowDying
 Q187493 Some Netscape Client Certificates Rejected by IIS
 Q187508 FTP Server Fails to Respond If First Binding Does Not Work
 Q187518 Apps Using Beep API on Multiprocessor Systems May Crash
 Q187519 NTBackup Will Not Run from Command Line with Blank Space
 Q187520 Tandberg SL5 Tape Device Not Auto-Detected in Window NT 4.0
 Q187555 WINS Incorrect Version ID Assigned During Scavenging
 Q187576 Stop 0x0000000A May Occur in TCP/IP
 Q187577 STOP 0xA Because of Spin Lock in Sfmatalk.sys on DEC Alpha
 Q187615 Setup Hangs When System Includes More Than Two RAW Drives
 Q187669 Unable to Use NetBIOS Resources over SLIP
 Q187672 Access Violation in RAS Using Multilink
 Q187686 LookupAccountSid Causes Access Violation on Multihomed System
 Q187696 Changes to Calculator in Service Pack 4
 Q187705 Application Error in CorelWEB.GALLERY
 Q187708 Cannot Connect to SQL Virtual Server via Sockets in Cluster
 Q187709 Domain Name Resolver Caches Responses
 Q187769 Application Error in NTVDM Running cc:Mail Utilities
 Q187802 DHCP Assigns "Bad_Address" to "Host Unreachable"
 Q187830 Performance Decrease Transmitting Data over the Network
 Q187856 IIS: Limit SSL Message Size to 16 KB for Netscape
 Q187884 CoCreateInstance on Multiple Threads Causes Hangs or Failures
 Q187936 Application May Hang Calling LogonUser() API
 Q187939 IPX May Not Work When Packet Size Is Larger Than Receive Buffer
 Q187940 Input Filters over IPX WAN Routing May Fail to Filter Packets
 Q187941 An Explanation of the New CHKDSK /C and /I Switches
 Q187947 100 Percent CPU System Handle Problem
 Q187964 MGI PhotoSuite May Paste Screenshots as Garbage or an AV Occurs
 Q187999 "Access Denied" w/ Personalization & Membership Authentication
 Q188000 Cannot Enter Stand-Alone Dieresis Character on Swiss Keyboards
 Q188027 Performance, Audit Logging, and Fixes to the DHCP Service
 Q188303 Random Stop 0x50 Errors on Cirrus Video Adapters
 Q188312 Lexmark Optra E+ Unprintable Region Is Incorrect
 Q188315 Stop Error Message in Sfmsrv.sys
 Q188414 Random Stop 0x0000000A When Running IPX over Token Ring
 Q188424 Multilayered Display Driver Produces Black Line in Word
 Q188571 STOP 0x0000000A in Netbt.sys Caused by Invalid DNS Record
 Q188652 Error Replicating Registry Keys
 Q188700 Screensaver Password Works Even if Account Is Locked Out
 Q188806 "::$DATA" Data Stream Name of a File May Return Source
 Q188838 Task Manager CPU Usage Only Displays Eight Processors
 Q188879 RPC Endpoint Mapper Will Not Register All Interfaces
 Q188896 Access Violation in Explorer.exe Changing Share Permissions
 Q189010 SBS: RAS Leases Six Addresses from DHCP
 Q189011 Using Performance Monitor Remotely Causes Access Violation
 Q189012 Clicking Default Scope Does Not Open Active Lease Window
 Q189013 Atapi.sys Does Not Support Multiple Logical Devices
 Q189032 Floating Point Arguments Won't Pass Between NT RPC and IBM RPC
 Q189061 Repeated Regsavekey/Regrestorekey Actions Corrupt Registry Hive
 Q189080 TCP Connection May Drop When Transferring Large Amounts of Data
 Q189114 NetDDE Refuses Incoming WM_DDE_INITIATEs from Windows 95
 Q189119 UserEnv Returns Corrupted Profile for All Failures
 Q189171 WinSock Applications May Fail or Stop Responding
 Q189225 LMMIB2 Unable to "Walk" from .1.3.6.1.4.1.77.1.4.4
 Q189245 Lmmib2.dll Does Not Support All Objects
 Q189262 FTP Passive Mode May Terminate Session
 Q189276 ODBC Causes Access Violation in 16-Bit Winsock
 Q189283 No More Than About 570 Reservations Visible in a DHCP Scope
 Q189290 Loss of Desktop After Logon When Using a Filter Gina.dll
 Q189291 Hang in Winlogon on Workstation Locked Dialog Box
 Q189395 Support for Canadian ACNOR Keyboard
 Q189462 Only Partial Pages Displayed or Error "The Connection Was Reset"
 Q189471 WpuOpenCurrentThread Does Not Work
 Q189522 Network Drive Letters in PATH Statement Causes Excessive Traffic
 Q189579 F11 and F12 Keys Do Not Function in MS-DOS Applications
 Q189606 Browser Service Fails to Start or Stop Button Is Unavailable
 Q189612 Access Violation Occurs in Windows NT Explorer (Explorer.exe)
 Q189756 PerfMon Percentage of Registry Quota in Use Displayed Wrong
 Q189988 CMPXCHG8B CPUs in Non-Intel/AMD x86 Compatibles Not Supported
 Q190009 Client Cert. Mapping Only Works w/First Page on Proxy Connection
 Q190010 Logging Performs Unwanted Flushes of Log Data Buffer
 Q190011 Perl Script Mappings Converted to Uppercase During Upgrade
 Q190015 Setting LogonMethod to Batch Causes "Parameter is Incorrect"
 Q190288 SecHole Lets Non-administrative Users Gain Debug Level Access
 Q190354 Unattended Setup of MSCS with -JOIN Parameter Requires Input
 Q190449 Corrupted SAM Hangs Windows NT Server
 Q190506 WINS Replication Problem Events 4262, 4261, and 1c Replication
 Q190552 WinNT 4.0 DHCP Client Modified to meet RFC 2131
 Q190791 STATUS_CANT_WAIT Returned from an NTCreateFile Call
 Q190834 SCSI Adapter Is No Longer Visible from SCSI Adapters Utility
 Q190928 Poledit Spin Boxes Limit Max Value to 9999
 Q190931 Snmptrap.exe Ignores SNMP Trap PDU Greater Than 4,096 Bytes
 Q190932 SNMP Service Ignores SNMP Trap PDU Greater Than 4,096 Bytes
 Q191088 Printer Prompts for Paper with Dutch Workstations
 Q191098 Large File Copy Operation Causes Available Bytes to Drop
 Q191284 STOP 0x0000001E in Netbt.sys
 Q191285 Services for Macintosh Index Corruption on Large Volumes
 Q191309 ALT+Numeric Keypad Problem When CHCP Command is Used
 Q191362 FPNW Pass-Through Authentication from Trusted Domain May Fail
 Q191387 Unable to Run 16-bit Apps If FILES= Is Greater Than 255
 Q191418 Arcs Print Incorrectly with EMF on PCL Printers
 Q191419 GP Fault or Access Violation When Buffer Too Small
 Q191428 WINS Replication Fails If More Than 30 Partners Are Configured
 Q191614 Able to Commit More Memory Than Is Available
 Q191634 Group Policies Cause Excessive \PIPE\samr Connections on PDC
 Q191689 Incorrect Font Characteristics May Be Used on Imported Graphics
 Q191751 Smoothing Fonts Disabled Using ETO_GLYPHINDEX
 Q191756 Stop 0x1E Switching Between System Menus in Application Window
 Q191767 LogicalDisk Partition Missing in Performance Monitor
 Q191768 Date of Print Job May Be Displayed Incorrectly in Print Queue
 Q191775 WINS Service Fails to Start With More Than 99 PNG Entries
 Q191830 Memory Leak Due to Repeated Logon/Logoff May Corrupt Profiles
 Q191832 Access Violation in Hangul Version of Lotus Organizer 97
 Q191834 Network Problems That Occur When Logging Off May Corrupt Profile
 Q191850 Convert Reports Cannot Create Elementary File System Structures
 Q191852 Bhnetb.dll Leaks Memory in Winlogon.exe Process with NetMon
 Q191896 Printing to NT LPD Server from SUN OS 4.1.4 May Not Process C/R
 Q191915 Screen Saver Time-out is Limited to 60 Minutes
 Q191992 NdrConvert Causes Access Violation in RPC Client on WinNT 4.0
 Q192051 LDAP Does Not Authenticate on French WinNT Due to Encryption
 Q192056 Point and Print Functionality with More Than 20 Driver Files
 Q192104 Windows NT Does Not Start If Primary Partition Is Above 2 GB
 Q192126 Add Workstation Fails with RestrictAnonymous
 Q192127 BUG: RpcTestCancel() Always Returns Error Code 5
 Q192132 STA Threads Lose Thread Token
 Q192229 Login Script Group Membership Mapping on BDC Fail If PDC Is Down
 Q192266 Sockets-based Child Processes Are Not Stopped
 Q192267 Various STOP Errors When Opening Files on Novell NetWare Servers
 Q192293 IIS Stops ODBC Logging after Failing to Communicate with SQL
 Q192409 Open Files Can Cause Kernel to Report INSUFFICIENT_RESOURCES
 Q192453 MoveFile API from Windows 95 with Invalid UNC Causes STOP 0xa
 Q192457 Downloaded File May Be Saved in Incorrect Folder with IE
 Q192460 Matrox Video Driver Causes STOP 0x00000050
 Q192547 WINSADMIN Writes Invalid SP Time to Registry
 Q192690 Search: Unable to Connect to Catalog Server via Search MMC
 Q192736 STOP 0x0000000A Blue Screen on Alpha AXP
 Q192749 Multiple SSL Connections May Cause Error Starting Security Sys
 Q192774 Stop 0x0000000A in Tcpip.sys Processing an ICMP Packet
 Q192786 Event ID 11 Changed to an Informational Message
 Q193056 Problems in Date/Time after Choosing February 29 in a Leap Year
 Q193064 Pressing Cancel Button in Date/Time Utility Changes Date
 Q193090 Inetmib1.dll Causes Memory Leak in Winlogon.exe Process
 Q193106 Filesystem Filter Drivers may Unload Unexpectedly
 Q193121 Cannot Connect to DFS Leaf a Second Time if Server is NetWare
 Q193157 TCP/IP Does Not Allow MAC Addresses to Change Dynamically
 Q193169 Script Mappings Are Not Removed from the Registry after Migration
 Q193206 Acquiring SNMP Info For OSPF in RRAS Hangs
 Q193209 Gethostbyname Not Working Correctly with Only DUN Installed
 Q193233 Rpcss.exe Consumes 100% CPU Due to RPC Spoofing Attack
 Q193271 Cannot Create Virtual Directory in Administrator Program
 Q193371 WINS/DHCP Admin Show Expiration Dates 2000 - 2009 with One Digit
 Q193436 DHCP Client Shuts Down After Two Declines
 Q193499 Multiple RRAS Client Disconnects Cause Increased CPU Usage
 Q193525 Access Violation Occurs When Viewing Web Sharing Tab
 Q193526 W3SVC Counters Fail after a Successful Install
 Q193528 Internet Service Manager Does Not Allow Wildcard Redirections
 Q193529 Modem Sharing Clients Cause Stop 0x000001E on SBS
 Q193530 Access Violation in WINSCL When Using CR or SDB Parameter
 Q193532 Stop 0x0000000A When Running Executable from Floppy Disk
 Q193548 Stop 0x0000002E Using Qlogic Driver Version 2.29
 Q193596 RASMAN Registry Values Cannot Be Set Higher Than 0xFF
 Q193613 ADSI Paths Greater than 80 Characters Causes Access Violation
 Q193614 Viewing Computer from MMC Causes Access Violation to Occur
 Q193646 Event ID 10005 from DCOM After Installing IIS
 Q193654 Services Continue to Run After Shutdown Initiated
 Q193655 Multiple Entries for AUTOCHK Abort in System Log
 Q193686 SMTP Services Do Not Start Automatically After One Is Stopped
 Q193687 Invalid Handle Exception Error During SMTP Server Maintenance
 Q193688 HTMLA: Object Already Exists When Creating New Web Sites
 Q193689 IIS Security: Mapping IDC Reveals Paths for Web Directories
 Q193779 Cluster Server Drive Letters Do Not Update Using Disk Admin
 Q193781 Cache Manager May Cause Data Corruption
 Q193793 ":$DATA" Data Stream Name Returns Source of a Remote File
 Q193806 CSNW Error 85, Local Device Already in Use
 Q193812 Extended Characters in URL Translated into UTF-8 Characters
 Q193891 HTTP Through Firewall and "Bypass Proxy for Local Intranet"
 Q193899 Event ID 1008, 4005 with Missing TCP/IP Performance Counters
 Q194130 SNMP Edit Box Drops a Character When Writing to the Registry
 Q194133 Remote Shell (RSH) Commands Hang w/ Multiple Sessions Running
 Q194193 STOP 0xA in Sfmatalk.sys When Copying Files on an SFM Volume
 Q194194 DNS Fails with Error 1201 If Secondary Zone File Not Specified
 Q194200 Cannot Change WinNT Passwords from Exchange and Outlook Clients
 Q194228 Rule Containing Multiple Clauses Only Functions Properly Once
 Q194322 T/R NIC May Fail Windows Hardware Quality Lab (WHQL) Test
 Q194336 ERROR: Destroyed NTFS Directory
 Q194340 Access Violation when Using Rcp.exe to Copy to Unix
 Q194341 Simple TCP/IP Services Can Be Driven to 100% CPU
 Q194393 New Window From Here Option in MMC May Cause Fatal Error
 Q194424 DHCP Server May Fail to Record Lease
 Q194429 TCPIP Timewaitstate may not remain in 2*msl
 Q194431 Applications May be able to "Listen" on TCP or UDP Ports.
 Q194465 PPTP May Refuse Connections When VPNs Are Free

Service Pack 3

 Q135707 Programs Run at Priority Level 15 May Cause Computer to Hang
 Q139506 Connections to Share-Level Server May Fail
 Q140419 Name Release Notifications Not Sent to WINS on Shut Down
 Q140967 Changing Password in User Manager Does Not Permit Logon
 Q141189 BUG: Wrong Error Code on NetBIOS Call When Using NWNBLNK
 Q141381 Retail SP3 Clients Cannot Connect to SP3 Beta 1 Servers
 Q142047 Bad Network Packet May Cause Access Violation (AV) on DNS Server
 Q142609 Corruption Problem When Running DPMI Application
 Q143470 Run Logon Scripts Synchronously Not Applied to New Users
 Q143472 FPNW Blue Screens Accessing or Creating Folders with Long Paths
 Q143473 Unattended Setup Stops Unexpectedly
 Q147012 Activating /W Switch to Prevent Rebooting in WinNT
 Q149538 System Restarts Every 5 Hours if Workstation to Server Upgrade
 Q151926 Delayed WinLogon When Drive Mapped to Local Share
 Q152273 DHCP Server May Give Out Duplicate IP Addresses
 Q153220 DHCP Manager Error "No More Data Is Available"
 Q154710 Cannot View Long File Names on Network in 16-Bit Programs
 Q154939 CreateQueueJobAndFile Fails w/ Queues Other Than Print Queue
 Q156410 STOP 0x1E or 0x50 Error on Multiprocessor DEC Alpha Computer
 Q157077 Netstat Slow to List Large Numbers of Connections
 Q157745 Command Extensions Cause Access Violation in Cmd.exe
 Q158433 Re-creating Admin Shares Causes Exception Error
 Q158548 Sysdiff Changes Dates on Files It Applies to WinNT
 Q159060 Mouse Cursor Freezes or Fails with Microsoft IntelliMouse
 Q159176 XADM: Store Stops Responding with High CPU Usage
 Q159330 Map.exe Does Not Set Environment Variables Correctly
 Q159998 Error Message: Error Access Is Denied
 Q160386 Incorrect MediaType Parameter on IBM PCMCIA Token Ring Card
 Q160405 Video Memory Not Correctly Detected on Dell Latitude Laptops
 Q161038 Winsock Apps Fail on First Attempt at NetBIOS Name Resolution
 Q161368 Service Pack 2 May Cause Loss of Connectivity in Remote Access
 Q161432 WINS Static Entries Overwritten by Duplicate Group Names
 Q161644 STOP 0x0000000A Sfmsrv.sys When Copying File to Mac Volume
 Q161714 IPX Doesn't Function Correctly over Token Ring Source Routing
 Q161830 Message from Unix Using Smbclient w/ Long Username Crashes
 Q161838 Programs That Lock 0 Bytes at Byte 0 Lock Entire File
 Q162077 Stop: 0x0000000A when Selecting NDS Map Objects
 Q162096 SET: Drivers Fail to Load When I/O Address Is Above 0xFFF
 Q162189 Macintosh Clients May Hang Temporarily with Multiple Mac Volumes
 Q162396 Problem with DHCP Decline Feature in Service Pack 2
 Q162404 Service Pack 5 Breaks Microsoft Mail Shared Using FPNW
 Q162471 Windows NT 4.0 May Not Recognize SCSI Devices Using Nonzero LUNs
 Q162563 WINS Restore Fails on Windows NT Server 4.0
 Q162566 FPNW Causes Incomplete Display When Executed from Windows 95
 Q162567 Telnet to Port 135 Causes 100 Percent CPU Usage
 Q162616 Extra Form Feed with Passthrough Functions to Text Only Driver
 Q162657 Choosing Default Domain Name for RAS Client Authentication
 Q162774 Policy Editor Crashes When Using Large Custom ADM Files
 Q162775 Access Violation in SPOOLSS when Printing to a Serial Printer
 Q162778 WINS May Report Database Corruption w/ More Than 100 Owners
 Q162881 RIP Table Sent While Shutting Down When Silent RIP Set
 Q162926 STOP: 0x0x0000000A After Call to GlobalAddAtom()
 Q162927 Telnetting to Port 53 May Crash DNS Service
 Q163129 RAS Client Fails to Connect to Service Pack 2 Using NetBEUI
 Q163143 STOP: 0x0000001E with Status C000009A
 Q163196 New Windows NT PING.EXE Prevents Hanging Other TCP/IP Stacks
 Q163202 Limit of the Number of Simultaneously Open Root Storage Files
 Q163203 Remote Access Autodial Manager may fail for second user logon
 Q163213 WebSTONE Benchmark of IIS May Show Poor Results for MP Systems
 Q163214 RAS Script with Set IPADDR May Fail with 3Com Defender Add-on
 Q163261 DEC ALPHA WinNT 4.0 Servers w/ SP2 Fail to Lease DHCP Addresses
 Q163267 Delay While Establishing SPX II Connection
 Q163318 Helpfile Word Lists May Be Rebuilt After Daylight Savings Change
 Q163333 Autosynch Compatible COM Applications May Fail w/ FIFO Enabled
 Q163383 Failure to Obtain IP Address Via DHCP on Token Ring w/ SP2
 Q163431 16-Bit Application Stops Responding When Run on WinNT 4.0
 Q163508 STOP 0xA in Ntfs.sys During Reboot
 Q163512 Error: The Mapi Spooler has Shut Down Unexpectedly
 Q163525 Delay When Saving Word 7.0 File to Windows NT 4.0 Server
 Q163538 NTBackup Does Not Properly Eject Tapes on DLT Tape Devices
 Q163614 HP LaserJet Series II Prints Extra Small Stripes or Points
 Q163616 Cannot Unlock Workstation If Password Change Cancelled
 Q163620 STOP 0x50 in Rdr.sys If Pathname Too Long in SMB
 Q163672 Windows NT 4.0 Setup Fails on ThinkPad 535
 Q163687 Winsock Applications May Timeout or Fail with an Error
 Q163700 IIS Access Violation for Polygon with More Than 100 Vertices
 Q163714 ATDISK Finds the Same Disk Twice on SunDisk PCMCIA ATA Adapter
 Q163725 NDIS Driver Fails To Check Functional Address
 Q163790 RPC Service Stops Responding on UDP Port 135
 Q163872 Sysdiff Cannot Delete Files
 Q163873 Czech Keyboard Layout Has Wrong Mapping
 Q163874 Pressing CTRL+ALT+DEL When Logging On Can Cause Blue Screen
 Q163875 Group Policies Not Applied If DC Name Is More Than 13 Characters
 Q163876 CSNW Clients Cannot Delete Print Jobs on NetWare Print Queue
 Q163880 COPY Command Causes File Cache to Grow
 Q163881 Windows NT Does not Display Some Fonts
 Q163883 NetBT (tag=Nbt8) Corrupts Pool with WinNT 4.0 SP2 Installed
 Q163891 Microsoft Excel 97 Causes a Windows NT Access Violation
 Q163892 A Service May Not Set Hooks on 32-bit GUI Applications
 Q163936 CLOCK Hangs and Consumes 90% CPU When Set to Digital Display
 Q163969 Event 552: DNS Was Unable to Serve a Client Request
 Q164014 Slow Exchange Client Logons Due to Deadlock in LSASS
 Q164121 Corel Fonts Unavailable Outside of English Locale
 Q164133 Logon Allowed When Access Denied to Mandatory User Profile
 Q164138 Files in Macintosh Volume Disappear from Macintosh Clients
 Q164159 Verify Reports Errors When Restoring a Tape Backup
 Q164161 NTBACKUP Fails to Back up Microsoft Exchange Server Data
 Q164201 Access Violation Installing IIS
 Q164211 FPNW Doesn't Convert the Long File Names Correctly
 Q164260 Compressing and Uncompressing Files Cause File Cache to Grow
 Q164309 Windows NT Client: Primary/Secondary WINS Servers Switch
 Q164322 Memory Leak in NetQueryDisplayInformation API
 Q164350 NEC IDE CD-ROM Drive CDR-1400C Cannot Play Audio CDs
 Q164352 Stop 0x00000050 in Tcpip.sys Caused by Winsock Applications
 Q164391 WinNT 4.0 SP2 Atapi Claims IRQ for Unused IDE Channel
 Q164410 CHGPASS and SETPASS Do Not Prompt For Typing Correction
 Q164432 Accented Greek Characters Are Not Being Created
 Q164462 Conner 4 mm DAT Tape Devices Fail After About 30 Seconds
 Q164491 Stop: 0x0000000A in Rdr.sys When Mailslot Message > 512 Bytes
 Q164507 Any User Can Log on to FTP Server with Disabled Anonymous Logon
 Q164542 MGET to an IBM Host FTP Server Returns Garbage Characters
 Q164546 SCSI Driver Description Truncated in Control Panel
 Q164595 Duplicate Route Not Removed After Second Redirection
 Q164600 4 mm DAT Driver Reports DEC TZ9L Supports Setmarks
 Q164606 Deferred Reconnections to Password Shares May Not Work
 Q164630 RPC over NetBEUI Fails from WinNT 4.0 RAS to WinNT 4.0 RAS
 Q164631 Scavenging WINS Database Removes Static Entries
 Q164639 SNA Windows 95 Fails Logon If Password Change Required
 Q164702 WINDISK crashes during initialization when Compaq ATAPI PD/CD
 Q164758 Remote Procedure Call (RPC) Service Access Violation
 Q164806 CHKNTFS Does Not Exclude FAT Partitions from AUTOCHK on Boot
 Q164812 Computer Name Truncated When Name Resolution Attempted
 Q164821 DHCP Server Service May Stop Responding
 Q164826 Direct Draw Programs May Hang NT 4.0 with S3 968 Video Chipset
 Q164904 Stop 0x0000000A in NETBT.SYS After Applying Service Pack 2
 Q164928 Not All Objects Are Displayed When Browsing NDS Trees
 Q164938 Event Logging Frozen While Doing Heavy Logging; Services CPU Peg
 Q164982 Lack of Secondary Address May Cause DNS Service to Hang
 Q164987 Hard-coded Socket of 451 Causes LANtegrity Software to Fail
 Q165004 NTVDM Support for Compaq Financial Keyboard Scan Codes
 Q165245 DDE Client Experiences Intermittent DDE Disconnects
 Q165314 Grace Logon Remaining Is Not Decremented When Logging to BDC
 Q165388 Invalid Directory Returned When Attempting to Access FPNW
 Q165427 Convlog.exe May Cause Access Violation
 Q165443 NDS Login Script Fails When Checking "If Member Of"
 Q165456 STOP 0x0000000A in Ntoskrnl.exe
 Q165483 RasEnumEntries() API Leaks Memory
 Q165813 16-bit Applications Cause Access Violation in NTDLL.DLL
 Q165814 Stop: 0x0000001E When Opening My Computer
 Q165816 STOP 0x0000000A in HAL.DLL on Multiprocessor Computers
 Q165818 Truncation of Backup Log In Eastern Europe or Russian NT 4.0
 Q165946 RasEnumEntries Return Incorrect Number of Phonebook Entries
 Q165950 Unable to Change Font Cartridge Selection
 Q165989 GetPeerName() Returns WSAENOTCONN After Select() Returns Success
 Q166043 DHCPAdmin Incorrectly Writes the BootFileTable in the Registry
 Q166148 RasSetEntryProperties() Fails to Set Options in Service Pack 2
 Q166158 Access Violation Occurs in SPOOLSS.EXE
 Q166159 Connecting to Windows Network resources from multi-homed machine
 Q166183 FPNW Server Returns Error When User Opens More Than 256 Files
 Q166186 OS/2 with TCP\IP May Refuse Socket Connections from Windows NT
 Q166197 NBTSTAT Error when Using >25 Dialout Devices with RAS
 Q166222 Dlc.sys Sends Frame Reject (FRMR) and Drops Connection
 Q166224 SNA Server 802.2 Connection Fails to Reactivate
 Q166226 Backup of Local Registry Does Not Work With NTBACKUP.EXE /b
 Q166257 Applications Using OpenGl Cause Access Violation in OPENGL.DLL
 Q166265 Printing To A Postscript Printer May Cause A STOP 0x0000003b
 Q166266 STOP 0x0000000A Using OpenNT Commands and Utilities
 Q166267 Office Shortcut Bar Fonts Appear as Non-Cyrillic on Russian NT
 Q166311 Memory Leak Retrieving OLE Property Values with Service Pack 2
 Q166334 OpenGL Access Violation on Windows NT Version 4.0
 Q166421 FPNW Returns Time Stamp with 60 Seconds to Clients
 Q166423 Access Violation in SERVICES.EXE in EVENTLOG.DLL
 Q166475 NWLNKSPX Retransmission Problem Over a Slow Link
 Q166478 Logon Rights Are Not Audited
 Q166482 DUMPCHK.EXE Incorrectly Reports Some Dump Files as Invalid
 Q166686 RASDIAL Error w/English Text on Non-English Version of Windows NT
 4.0
 Q166696 NT 4 Err Msg: "The INF OEMNADDI is missing the referenced file"
 Q166823 Cannot Connect To AT&T Advanced Server VMS or OSF Print Share
 Q166834 Lost Record Locks from MS-DOS-based Program to NetWare Server
 Q166842 CSNW & GSNW Won't Display NetWare Servers via a SAP Seed Server
 Q166846 Cannot Reconnect to TN3270 Server with Close Listen Sockets
 Q166874 No Crashdump and Compaq Systems with Smart-2/P (PCI) Controller
 Q166963 Cannot Communicate with Computer Running NWLink IPX/SPX
 Q166964 Incorrect File Listing on NetWare Server with DIR /TC Command
 Q167009 Description of DHCP Server Service Has a Misspelled Word
 Q167010 Access Violation in CMD.EXE Processing Batch File Script Argument
 Q167026 Windows NT 4.0 DNS Server Stops Responding To Queries
 Q167038 RAS Clients Run Winsock and RPC Applications Slowly
 Q167044 Request From Perfmon Counter Can Cause Excessive Page Faults
 Q167110 NT 4.0 RAS client slows over time due to lack of resources
 Q167129 Stop 0x7A or System Lockup in NTBACKUP With MINIQIC
 Q167130 Fatal System Error in NDIS.SYS Allocating Map Registers
 Q167362 STOP 0x00000050 in SRV.SYS When Shutting Down Computer

Service Pack 2

 Q108261: Windows NT Hangs on Shutdown with Certain PCMCIA Devices
 Q140059: Stop 0xA in Afd When Browsing IIS
 Q140065: Multi-Processor Systems Randomly Restart or Stop Responding
 Q141375: Winstone 97 May Fail on Windows NT 4.0
 Q142634: Multiple Processes Are Able to Open the Same Winsock Port
 Q142641: Internet Server Unavailable Because of Malicious SYN Attacks
 Q142648: STOP 0x00000024 in Ntfs.sys
 Q142656: Internet Explorer 3.0 on RISC Computer Cannot Connect to Host
 Q142671: Backup Fails on Certain Directories Due to Lack of Permissions
 Q142675: CSNW Sends Packets Greater Than Negotiated Maximum Packet Size
 Q142686: First Line of Print Job Lost When Printing Using Lpdsvc
 Q142687: Windows NT 4.0 Not Able to Read Some Compact Discs
 Q142847: Bugcheck 0x1e Caused by Isotp.sys Driver
 Q142872: Length of PDC Name May Affect Performance on a Domain
 Q142903: Windows NT Ndis.sys and Netflx3.sys Performance Improvement
 Q146336: Joystick in Windows NT 4.0 Does Not Work Properly
 Q147363: AlphaServer Hangs on Install of Windows NT Version 4.0
 Q147497: Matrox Video Driver May Fail on Alpha-based Computers
 Q147552: Backup Always Reports Time as PM
 Q148378: Setup of RAS with Multiple Modems Gives Slow Performance
 Q148525: Removable Media Does Not Eject if Formatted in NTFS
 Q148602: Running SNA Server 2.11 on the Windows NT 4.0
 Q150815: Windows NT May Fail to Boot on Toshiba Portable Computers
 Q153665: SPX Data Stream Type Header May Reset Unexpectedly
 Q154556: Delegation Requires a Stop and Restart of the DNS Server Service
 Q154620: Windows NT 4.0 DNS Server Loses the Forwarders Settings
 Q154784: Windows NT Operating System SNMP OID Incorrect
 Q155883: NT 4.0 Breaks SNA Server 2.x Server Communication Over IP
 Q156091: Access Violation with Long NDS Context in CSNW/GSNW
 Q156095: Replace Command with Space Character in the Path Does Not Work
 Q156276: Cmd.exe Does Not Support UNC Names as the Current Directory
 Q156324: Device Failure Message with Microchannel Network Adapter
 Q156520: Logon Validation Fails Using Domain Name Server (DNS)
 Q156578: Cannot Cancel Print Job on Windows NT 3.51 Shared Printer
 Q156735: WOW Applications Stack Fault When Launched by a Service
 Q156746: Print Jobs Are Deleted When Printer Is Resumed After Restart
 Q156750: AddGroupNameResponse Frame from WinNT May Cause WFWG to Hang
 Q156884: Problems Saving Event Viewer Log from Windows NT 4.0 to 3.51
 Q156958: Serial Service Won't Stop with Serial Printer Installed
 Q157279: Nwrdr.sys Fails Reading File with Execute Only Attribute
 Q157289: Memory Leak Using RegConnectRegistry API
 Q157494: PPC 4.0 Cirrus Driver Fails to Redraw & Fill Objects Correctly
 Q157621: Personal Groups Not Visible If %Systemroot% Is Read-Only
 Q157673: Policy Not Updated on Workstation
 Q158142: WM_DDE_EXECUTE API Causes a Memory Leak in the WOW Subsystem
 Q158387: RAS Server Cannot Use DHCP to Assign Addresses w/ PPTP Filtering
 Q158587: 16-Bit Named Pipe File Open Leads to WOW Access Violation
 Q158682: Shortcuts Created Under NT 4.0 Resolve to UNC Paths
 Q158707: DDE Destroy Window Code May Stop 0x0000001e in Windows NT 4.0
 Q158796: Macintosh Clients Connected to WinNT Server Appear to Hang
 Q158981: IBM Thinkpads 760ED and 760ELD May Hang During Shutdown
 Q159053: NTFS Stream Limitation in Windows NT 4.0
 Q159066: A Client Crash May Prevent an NTFS Volume Dismount
 Q159071: NTFS Does Not Prevent a File Deletion During Rename
 Q159072: An Account That Still Has System Access May Be Deleted
 Q159073: Screen Corruption on Dell Laptops Using Cirrus Video
 Q159075: Compression Is Not Supported on Quantum 4000DLT
 Q159076: Windows NT 4.0 May Hang or Crash in Win32k.sys During Setup.
 Q159085: Windows NT Kernel Crashes While Processing WM_NCCREATE
 Q159090: Delphi 2.00 and 2.01 Users Encounter Error 998
 Q159091: German Time Zone Results in Incorrect Log Times
 Q159092: Mouse Buttons Not Swapped on German Windows NT 4.0
 Q159093: Windows NT Muldiv() Function Returns Incorrect Value
 Q159095: STOP 0x0000001E in Win32k.sys When Exiting Applications
 Q159098: WinNT 4.0 Resource Kit Utility "Remote Console" Client Fails
 Q159105: Cannot Open Truncated File Names from Compact Discs
 Q159107: Access Violaion in AddAtom Inside Kernel32.dll
 Q159108: SMP Full Duplex Adapter Configuration May Cause a Blue Screen
 Q159109: ExitWindowsEx Does Not Work With NEC Power Switch Service
 Q159110: CDFS Does Not Complete IRPs Correctly
 Q159111: Multiprocessor Computer Hangs Under Stress Using Halsp.dll
 Q159119: NTFS Generates Cross-Linked Files
 Q159127: Bugcheck in Windows NT While Running POSIX Applications
 Q159129: OpenGL Access Violation with Invalid OpenGL Context
 Q159137: Moving Files Can Corrupt NTFS Partition
 Q159141: CDFS Incorrectly Creates Short File Names for Some Files
 Q159144: Dongle May Not Function Under Windows NT 4.0
 Q159203: Unattended Install Prompts for New IP if Zero Is in Address
 Q159204: IoCompletionPort Causes Blue Screen Error
 Q159205: SFM File Type and Creator Properties Invalid
 Q159206: Reactivation of Paused Print Queues Deletes Print Jobs
 Q159309: Windows NT 4.0 RAS Not Releasing Static IP Addresses
 Q159352: RPC over NetBIOS Programs Can't Call from Server to RAS Client
 Q159447: Applications Testing for Directory Existence Fail
 Q159449: DNS Server Glue Data Is Deleted
 Q159450: Second Recursive Query Sent from DNS Server Is Broken
 Q159594: Missing Eastern Europe FontSubstitutes in Registry
 Q159910: Memory Corruption on a Windows NT Alpha Platform
 Q159970: Slow List of Folders and Files with CSNW
 Q159971: SetTimer() API Causes Memory Leak in the WOW Subsystem
 Q159972: WinNT 4.0 May Not Return Valid Response for SMB Search Command
 Q160015: 2D Vector Performance on WinNT 4.0 Slower Than on 3.51
 Q160055: Warning Event ID 4010 Generated on Windows NT LPD Server
 Q160189: CSNW Cannot See More Than 32 Volumes Per Server
 Q160190: RasSetEntryProperties Does Not Save a Full Path Script Name
 Q160354: Mouse and Keyboard Can Disappear when Replacing Drivers
 Q160370: Stop Screen 0x00000050 Caused by Fs_rec.sys
 Q160372: Intermittent File Corruption when Compiling on NTFS Partition
 Q160373: Adaptec Aic78xx Does Not Issue Multiple Tagged Commands
 Q160377: File Size Data Does Not Remain Consistent After Defrag on NTFS
 Q160392: Systems with 4 GB or More of RAM Cannot Boot Windows NT 4.0
 Q160398: Cannot Read Files Greater than 4 GB
 Q160404: Madge EISA Stops Responding on Alpha in Windows NT 4.0
 Q160405: Video Memory Not Correctly Detected on Dell Latitude Laptops
 Q160420: Changing Colors on Cirrus Logic Cards to 65k Can Cause Stop
 Q160459: DNS Delegations May Fail
 Q160470: Stop 0x0000000a IPX Sends Browser an Incomplete Datagram
 Q160493: NWLNKRIP Data Structures Corruption when Using a Demand Dial NIC
 Q160494: DNS Zone Transfer Fails After WINS Record Added
 Q160497: Cache File Entries Disappear
 Q160508: Unnecessary DNS Zone Transfers
 Q160518: Zone Files in Multiples of 4 KB May Cause Access Violation
 Q160583: Windows NT 4.0 with More Than 4 Processors May Stall & Reboot
 Q160601: Bad Parameters Sent to Win32k.sys May Cause Stop Message
 Q160603: No Output from DBMON Using OutputDebugString While Debugging
 Q160604: Access Violation in security!SspQueryContextAttributesW
 Q160606: Performance Enhancements for SQL Server Under Windows NT
 Q160610: READ_REGISTER_ULONG Doesn't Preserve ULONG Semantics on Alpha
 Q160649: STOP 0x0000000A in Ntoskrnl.exe at Logon to Windows NT 4.0
 Q160650: Blue Screen When Closing Kernel Mode Handles from User Mode
 Q160651: OpenGL May Cause an Exception 0xc0000090
 Q160653: NTFS Fails Assertion Under High Stress During Transfer
 Q160657: 16-bit Version of Visual Basic 4 May Hang Windows NT 4.0
 Q160658: Stop C0000021A Using MoveFileEx MOVEFILE_DELAY_UNTIL_REBOOT
 Q160670: FPSCR is Not Being Saved Across Thread Context Switches
 Q160671: Stop 0x0000007F May Occur on Compaq SystemPro
 Q160678: Possible Access Violation in Win32k.sys Under High Stress
 Q160702: Event 2006 Errors in Xcopy from WinNT 4.0 to OS/2 3.0 Client
 Q160732: FIX: SQL Server 6.5 Service Pack 2 Fixlist (Part 2 of 2)
 Q160791: Excel Charts Lose Color When Pasted into Word
 Q160840: Sharing Violation When Accessing User Profiles
 Q160894: Incoming Fax Jobs Do Not Appear in Print Queue
 Q160964: 0x0000001e When Printing Certain Documents from Windows NT 4.0
 Q161201: NTBackup.exe from WinNT 3.51 SP5 Causes Verify Errors
 Q161802: Stop 0x0000000A During Create File SMB
 Q161990: How to Enable Strong Password Functionality in Windows NT
 Q162157: Cyberbit Unicode Font Does Not Return Correct Charset
 Q163055: DHCP Client May fail with NT 4.0 SP2 Multinetted DHCP Server
 Q163736: Access Violation in DNS Manager when deleting cached domain
 Q163772: Nested "for" Loops Using the '~' Operators Does not Work
 Q163773: Brief 3.0 in NTVDM Consumes 100% Processor
 Q163837: SNMP query to Windows NT returns same value for NTS and NTW

Service Pack 1

 Q78303: Intermittent File Corruption Problem
 Q142653: STOP Message Occurs Calling GetThreadContext/SetThreadContext
 Q142654: Winsock Memory Access Violation in Ws2help.dll Or Msafd.dll
 Q142655: Stop Message Appears After Deleting ProductOption Registry Key
 Q142656: Internet Explorer 3.0 on RISC Computer Cannot Connect to Host
 Q142657: Data Corruption on Windows NT 4.0
 Q142658: Internet Information Server Runs Out of Memory
 Q149903: File Manager Performs a Move Instead of a Copy
 Q156832: STOP Message when IBM Warp Client Connects to Windows NT 4.0

Q. When should I reapply a Service Pack?

A. You should reapply any Service Pack (and subsequent hotfixes) whenever you add any system utilities/services or hardware/software. A good rule of thumb is if the computer says "Changes have been made you must shutdown and restart your computer" reapply your service pack before the reboot.

The only problem is once you reinstall a service pack, unless you uninstall then reinstall, you will lose the ability to uninstall it.

Q. What is Option Pack 4?

A. Due to a lot of public pressure, Microsoft agreed to no longer include any new functionality in Service Packs, but would rather produce a separate add-on which would update various option components.

Option Pack 4 is the first of these (to keep in step with Service Pack 4) and can be downloaded from http://www.microsoft.com/windows/downloads/contents/updates/nt40ptpk/default.asp or is supplied as part of MSDN. The download is about 27MB.

If you download from the web you have to download a special program, download.exe, which you then run which downloads or installs the software.

Included in Option Pack 4 are:

Internet Information Server 4.0 (which used the new Microsoft Management Console which is standard in NT 5.0)
Microsoft Transaction Server 2.0 (this is tied in with IIS)
Microsoft Message Queue Server 1.0
Internet Connection Services for Microsoft RAS
Certificate Server
Site Server Express
SMTP Server
Message Queue Server

More information can be found at http://www.microsoft.com/NTServer/Basics/WhatNew.asp

To install the Option Pack you must be running Service Pack 3 or above (I tested with Service Pack 4 and you get warnings that it has not been tested on Service Pack 4 but it works fine) and you must have Internet Explorer 4.01 or above.

Once you start the installation you should click Next to the introduction screen and you will then have two options

Upgrade Only
Upgrade Plus

If you select Upgrade Only then only existing components on the system will be upgrade to Option Pack 4 version, clicking Upgrade Plus allows you to install extra software.

If you select Upgrade Plus you can then choose which components to install. Items such as IIS have sub-components such as NNTP server (news) which you can optionally install.

Depending on the components you selected you will be asked some minor questions and then the machine will reboot.

Q. How can I tell which version Service Pack I have installed?

A. When a Service Pack is installed using the normal method (e.g. not just copying the files to a build location) the service pack version is entered into the registry value CSDVersion which is under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion.

The value is of the formal "Service Pack n", e.g. "Service Pack 4" but can have extra information if it is a beta or release candidate, e.g. "Service Pack 4, RC 1.99".

To check this from the command line you could use the REG.EXE Resource Kit supplement 2 utility:

C:\>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion" REG_SZ CSDVersion Service Pack 4, RC 1.99

Make sure you put the value in double quotes (").

An alternative is to just run WINVER.EXE which will tell you your current build and Service Pack version. You can also use WINMSD.EXE or Help/About in Explorer.

Q. I receive an error trying to install Service Pack 4 for NT 4.0.

A. If when installing Service Pack 4 you receive the error:

"Service Pack Setup Error. You do not have permissions to update Windows NT. Please contact your system administrator."

it may be caused by the update.exe image being in the wrong directory.

If you have expanded the service pack using nt4sp4i.exe /x it will create a subdirectory, update, which will include the files

Update.exe
Update.inf
Update.nvt

When running update.exe it must be in the update subdirectory. If not you should move the image accordingly.

Q. Setupdd.sys is missing in Service Pack 4/5.

A. Setupdd.sys is included on the Service Pack 4/5 CD and in the Y2K download version of Service Pack 4 but not the normal version.

This file is needed to replace the one on the second Windows NT installation disk to repair a system that has Service Pack 3 or above. To create a set of NT installations disks insert the NT installation CD-ROM and type winnt32 /ox.

You can download SETUPDD.SYS here.

Q. Important steps for installing Service Pack 4.

A. Service Pack 4 makes some permanent changes to the registry and so before installing you should perform the following steps to facilitate a Service Pack uninstall in the event of a problem. Before installing the service pack make sure you have performed the installation on a test server and as with another "fix" don't install unless you need a fix supplied by the Service Pack or have been instructed to install it by a Microsoft support engineer. If it ain't broke, don't fix it.

Perform a full backup of all files and the registry using NTBACKUP or another backup program
Create an up-to-date Emergency Repair Disk and store safely
RDISK /s
Reboot your system and check the Event Viewer (Start - Programs - Administrative Tools - Event Viewer) and check for any errors. Fix before proceeding. If you make any changes fixing the problems go back to step 2 and recreate another ERD.
Copy your old Uninstall directory to a backup location
C:\> md %systemroot%\$ntservicepackuninstallback$ C:\> copy %systemroot%\$ntservicepackuninstall$ %systemroot%\$ntservicepackuninstallback$
Run the resource kit utility SRVINFO.EXE (if available) and keep a copy of the output
Disable any non-essential third-party drivers/services not required for starting the system. Contact the manufacturers to see if updated versions are available.
Check you have enough disk space, you will need 80MB if you select to create an uninstall directory, 40MB if not
Close all active debugging sessions or remote control sessions and any other non-essential applications before starting the upgrade

Q. Uninstalling Service Pack 4.

A. As was explained in "Q. Important steps for installing Service Pack 4.", Service Pack 4 makes some changes to registry which can't be undone. Because of this, in the event of a Service Pack 4 uninstall the following files are left unrestored

samsrv.dll
samlib.dll
winlogon.exe
lsasrv.dll
services.exe
msv1_0.dll

Additionally the files below are also not restored:

Crypt32.dll, Comctl32.dll, Schannel.dll, Cryptdlg.dll, Pstorerc.dll, Psbase.dll, Pstores.exe, Pstorec.dll, Cryptext.dll, Cryptui.dll, Mssign32.dll, Wintrust.dll, Softpub.dll, Mssip32.dll, Mscat32.dll, Initpki.dll, Cryptnet.dll, Xenroll.dll, Dssig.dll, Sigres.exe, Dssbase.dll, Reaenh.dll (128 bit security only), Rsabase.dll, Certmgr.msc, and Syske.exe.

To uninstall the Service Pack either start the Add/Remove programs control panel applet (Start - Settings - Control Panel - Add/Remove programs), select "Windows NT Service Pack 4" and click Remove, or, move to the %systemroot%\$NtServicePackUninstall$\spuninst directory and run spuninst.exe.

If you wanted to completely uninstall the service pack, undoing the registry changes and restoring all original files you would need to restore the %systemroot% directory from a back and repair the registry using the ERD disk you created. Alternatively you could uninstall as normal then use the ERD to repair the registry and replace the six files that the uninstall does not fix.

Q. How can I tell who installed/uninstalled Service Pack 4?

A. When Service Pack 4 is installed or uninstalled an Event is written to the System Event Log. The Event ID is 4353 so you could just create a filter (View - Filter Events) to view only Event ID 4353. It gives information of the person and time it was actioned.

The messages are

Windows NT Service Pack 4 was installed (Service Pack 3 was previously installed).

Windows NT Service Pack 4 was uninstalled. Restoring Windows NT to Service Pack 3.

Event 4353

Q. Service Pack 4 unattended installation switches.

A. The following switches can be used with UPDATE.EXE program supplied with Service Pack 4

-u	Unattended mode
-f	Force all apps to close at shutdown
-n	Do not create an uninstall directory
-o	Overwrite OEM files without asking
-z	Do not reboot when installation is complete
-q	Quiet mode - no user interaction

Q. New Event Logs in Windows NT 4.0 Service Pack 4.

A. Service Pack 4 adds 4 new Event log messages to the System Event Log:

Event 6005 is logged at boot time noting that the Event Log service was started.
The Event log service was started.
Event 6006 is logged at shut down time when the Event Log service is stopped
The Event log service was stopped.
Event 6008 is logged as a dirty shutdown.
The previous system shutdown at 07:51 on 15/02/99 was unexpected.
Event 6009 is logged during every boot and indicates the operating system version, build number, service pack level, and other pertinent information about the system.
Microsoft (R) Windows NT (R) 4.0 1381 Service Pack 4 Uniprocessor Free.

These can all be viewed using the Event Viewer which is located in the Administrative Tools program folder.

Q. When will Service Pack 5 for NT 4.0 be released?

A. Service Pack 5 is now released and expect SP6 to follow!

Q. I receive an error that setup.log cannot be found when installing a service pack.

A. If when you try and install a service pack you receive one of the following errors:

Service Pack Setup could not find the Setup.log file in your repair directory

Service Pack Setup cannot open or modify your SETUP.LOG file

The problem is either

SETUP.LOG in the %systemroot%\repair directory is missing or damaged
The folder in which Windows NT was installed has been renamed (although this is unsupported by Microsoft)

If the file SETUP.LOG in the %systemroot%\repair is missing then you can copy it off your Emergency repair disk however if this is not an option you could copy from another machine but you may need to update the first few number of lines in the file (I copied a setup.log file from a NT Server Terminal Server installation to an NT Workstation and installed Service Pack 5 with no problems after changing the device and directory! This is not a supported method though).

Below is an example of the first lines of setup.log

[Paths] TargetDirectory="\WINNT" TargetDevice="\Device\Harddisk0\partition2" SystemPartitionDirectory="\" SystemPartition="\Device\Harddisk0\partition1" [Signature] Version="WinNt4.0" [Files.SystemPartition] ntldr="ntldr","2a36b" NTDETECT.COM="NTDETECT.COM","b69e" [Files.WinNt] \WINNT\Help\31users.hlp="31users.hlp","12bfc" ... etc.

If you copy from another machine you may need to update the TargetDirectory and also the TargetDevice (which is where the %systemroot% is located and can be compared against the boot.ini file) and SystemPartition (which is the active partition, starting from 1, e.g. C:, this should not need to be changed).

If the TargetDirectory is different you should perform a global replace in the file from the old name, e.g. WINTSRV to the new name, e.g. WINNT.

If you do have a setup.log file in the repair directory and still get problems installing check that its format matches that given above.

If you don't have any SETUP.LOG files I have an example one you can download and modify from an NT Workstation installation (but don't mail me asking for support) but the correct procedure is outlined at http://support.microsoft.com/support/kb/articles/Q173/3/84.asp which involves reinstalling NT over your existing installation.

Q. What is new in Windows NT 5.0?

A. NT 5.0 is the next major release of NT. It is expected to include the following new features:

New X.500-style directory services called Active Directory. In the active Directory, domain controllers store the entire directory database for their domain. This directory information can be structured to create a hierarchical directory system.
Active Directory uses DNS as a locator service and supports LDAP queries.
Distributed File System. DFS, which was an add-on for NT4, enables multiple volumes on different machines (even not Windows NT!) to appear as a single logical volume.
Support for more than one monitor using new API commands (note that not all video cards are supported).
Kerberos security, which is a MIT developed security protocol and is used for distributed security within a domain tree and is based on passwords and private-key encryption.
64 bit memory support (more than 4 gigs of memory supported, 32 gigs on 64 bit processors) on Alpha processors.
Support for Plug and Play based on ACPI.
Common device driver model, so new drivers can work on both Windows NT and Windows 98.
Built in Disk Quota software - per user/per volume only.
Encrypting File System - file encryption on a per file or per folder basis (like compression at present)

For more information on what's new please goto http://www.microsoft.com/NTServer/Basics/Future/WindowsNT5/Features.asp

information on Windows NT 5.0?

A. Below is a list of useful links at Microsoft

Windows NT Server 5.0 Main Page http://www.microsoft.com/ntserver/windowsnt5/default.asp
Windows NT Beta page http://ntbeta.microsoft.com/

Q. How do I get the Microsoft Windows 2000 Beta?

A. Windows 2000 is currently in beta test. The technical beta program is closed and is not accepting additional requests at this time. The Windows 2000 beta is not generally available at present for free. If you want this beta, there are five approaches you can consider taking:-

Send email to betareq@microsoft.com The Technical beta is closed, and email to this account is unlikely to get you onto the beta. If you do send email, remember you need to justify why MS should send you the beta. Given that the Technical Beta is closed, this approach is unlikely to get you a beta copy.
Take out a subscription to MSDN (Microsoft Developers Network) Professional or Universal levels. MSDN Subscriptions offer comprehensive, timely, and convenient access to Microsoft Visual Tools, essential technical programming information, Microsoft operating systems, software development kits (SDKs), device driver kits (DDKs), Microsoft Office, BackOffice Test Platform, etc. See http://www.microsoft.com/msdn/join/subscriptions.htm for more details including pricing.
Microsoft has said that there will be a wider consumer preview of Windows 2000 now that Beta 3 has shipped. http://www.microsoft.com/windows/preview/
Take the Microsoft Official Curriculum course 1264, NT 5.0 First Look.
Purchase Technet Plus which includes beta products.
Order the Hardware evaluation Kit. For more details on this, see http://www.microsoft.com/hwtest/hctcd/

Q. What is Windows 2000?

A. Microsoft have renamed NT 5.0 to Windows 2000 in an attempt to simplify the product lines. Below is an extract from the Microsoft press release:

Four products to make up initial Windows 2000 offerings, all "Built on NT Technology".

The company has decided to rename the next release of the Windows NT® line of operating systems—formerly known as Windows NT 5.0—as Windows 2000. Now that millions of people use the Windows NT operating systems every day, Microsoft has decided to rename its next releases to reflect their shift into the mainstream market and to help customers understand the products. All currently released operating systems will retain their names.

The company has also expanded the Windows server line to meet customer demand for solutions that are more powerful than Windows NT Server Enterprise Edition and for lower cost clustering alternatives for branch-office servers.

"Windows NT was first released five years ago as a specialized operating system for technical and business needs. Today it has proven its value as the preferred technology for all users who want industry-leading cost-effectiveness, rich security features and demonstrated scalability," said Jim Allchin, senior vice president at Microsoft. "The Windows NT kernel will be the basis for all of Microsoft's PC operating systems from consumer products to the highest-performance servers."

The Windows 2000 line, which Microsoft will begin to roll out in 1999, will include four products. Windows 2000 Professional is a desktop operating system aimed at businesses of all sizes. Microsoft designed Windows 2000 Professional as the easiest Windows yet, with high-level security and significant enhancements for mobile users. The operating system is also designed to provide industrial-strength reliability and help companies lower their total cost of ownership with improved manageability.

Microsoft offers the Windows 2000 Server as the ideal solution for small- to medium-sized enterprise application deployments, web servers, workgroups and branch offices. Windows 2000 Server will support new systems with up to two-way SMP; existing Windows NT Server 4.0 systems with up to four-way SMP can be upgraded to this product.

Windows 2000 Advanced Server is a more powerful departmental and application server that provides network operating system and Internet services. Supporting new systems with up to four-way SMP and large physical memories, this product is ideal for database-intensive work. In addition, Windows 2000 Server integrates clustering and load-balancing support to provide excellent system and application availability. Organizations with existing Windows NT 4.0 Enterprise Edition servers with up to eight-way SMP can install this product.

Windows 2000 Data Server The Windows 2000 line will also include the new Windows 2000 Datacenter Server, which is the most powerful server operating system ever offered by Microsoft. Windows 2000 Datacenter Server supports up to 16-way SMP and up to 64GB of physical memory, depending on system architecture. Like Windows 2000 Advanced Server, it provides both clustering and load balancing services as standard features. Microsoft designed this product especially for large data warehouses, econometric analysis, large-scale simulations in science and engineering, online transaction processing and server-consolidation projects.

Microsoft believes its new Windows 2000 name will help both its partners and customers. "The new name also serves our goal of making it simpler for customers to choose the right Windows products for their needs," said Brad Chase, vice president at Microsoft. "The new naming system eliminates customer confusion about whether 'NT' refers to client or server technology. Also, with our across-the-board improvements in ease of use, mobile support and total cost of ownership that provide benefits to so many users, 'NT' technology is no longer just for high-end workstations." Microsoft will use the tagline "Built on NT Technology" to help its customers through the naming transition.

The company believes that the Windows 2000 name and NT tagline will help people to identify which operating system will work best in their environment. And—as the name implies—Windows 2000 is ready for the next millennium.

Q. Getting the most out of NT 5.0 beta 2.

A. Windows NT Expert Thomas Lee has submitted these tips for getting the most out of NT 5.0 Beta 2.0. Dated 04/11/1998

Now that NT5 Beta 5 Beta 2 Workstation and Server have been in the field for some time, some experience in these releases has been gained. In these public newsgroups, we often see issues being repeated since later users have not seen the related posts.

To help in assisting new users, I've complied what I modestly called:

THOMAS'S TOP 10 FAQ TIPS FOR NT5 BETA 2

I've written both specific answers to the these noted problems, plus some general tips on how to get the most out of NT5 B2.

I can't get DHCP to work.

Two things to check: first that the DHCP server has been authorised and second that the subnet has been activated, To find out more about setting up a DHCP server, refer to the Walkthroughs.

In general, read the walkthroughs for all the functions before asking more questions in the newsgroups. But if you are unclear, certainly post!

CDR is broken in B2

This is a known issue. But please file a bug report on your details, especially including your exact hardware configuration.

In general, try to read the older messages - the last couple of weeks or so to see if the issue has come up. A lot of issues are repeated, and repeated, suggesting, to some, that newsgroups are write only.

So how do I create a domain - there was nothing in the setup about that!

In Windows 2000, the creation of a domain controller is not done during the installation of the OS. With Win2k, you install the OS first then you create a Domain Controller by DCPROMO.EXE either from the command prompt of from Start/Run. Prior to running DCPROMO.EXE, you must install and setup a DNS service. For more details on setting up a DC, see advsetup.txt on the CD.

In general, please read all the files in the root of the CD before asking further questions in the newsgroup please! [J.S. There is also an example in the FAQ Q. How do I promote a server to a domain controller?]

Beta 2 is does not support my <pick your hardware device>

First, check the HCL in \support\hcl.txt to see if this card is supported. If it is and it does not work, try the standard tricks: take card out, see what works. Check the IRQs, etc. IF all else fails, file a bug report.

If your device in NOT on the HCL, file a bug report explaining the details of your system, the precise way the card fails (BSOD, installs but fails, reduced functionality). Also try Win98 drivers if you can find them. Finally file a bug report.

In general, the HCL is your friend. Please consider consulting it prior to asking questions on the newsgroups. Also, Help is your other friend - check Help for configuration questions.

The Find dialog is broken.

The find/search dialog does work, it's just not user friendly. This is a bug, and is "fixed in later builds" - a common reply to bugs submitted regarding this dialog!

But file searching can be significantly improved by use if the index server. This does devour a lot of disk resources initially ( it content indexes your entire disk setup).

Once it has completed the first pass (which can take hours depending how much disk space you have and hot much horsepower your system has. Initial indexing is an ideal task to kick off at night, and come back to seeing complete in the morning. Once installed, it's efficient, and is very useful for searching. Development staff, developing HTML, Office documents, C Code, etc., will love the ability to search for specific strings in the myriad of .cpp, .htm, .shh, .asp files, etc! Check it out.

In general, for certain users, Index server is a real pal.

I can't work out how to do something in NT5 B2.

Try looking in the help. The server help, especially, has a lot of really great background information. Help is massively different, and better, in Windows 2000 than in NT4! The Help text include documentation on how to carry out most basic configuration tasks, back ground concepts (and much of it well written), and places to go for more information (e.g. web sites, books, RFCs, etc). Take a look - Help has gotten a whole lot better.

In general, Help is a friend.

Why is this wise guy always asking me to read the documentation?

Simple, really. A number of procedures will be new, and the details of these are documented. Secondly, the release notes document known issues, work arounds, etc.

Windows 2000 is a lot different from NT4. I'd like to find the 'This sure isn't Kansas any more Toto' quote from the Wizard of oz as the start-up sound. MS are aware and really have tried to document the key points. The walkthroughs make a great self paced self study tour of Windows 2000 - enjoy the ride.

In general: the product documentation is your friend.

Why that guy always saying 'file a bug report'

Why IS that guy always telling me to file a bug report??? Well, to put it bluntly: The product shipped as NT5 B2 is in beta test. It is not a final product. There are most likely thousands of bugs still remaining ranging from serious show stoppers to trivial things that simply will never get fixed (e.g. the titles on a dialog box). That is not abnormal for such a large product this far from shipping.

Win2000 is simply NOT ready go to ship today - MS need to find, and resolve, these bugs. If you find something wrong, it may just be simple user error but it may well be a bug. So if you think it's broken, tell MS.

You, as future users, can influence and have helped to shape the product as it evolves. MS has listened to the feedback and are incorporating it. With the NT team embark on the death march to Beta 3, if you don't tell MS, you may well have to live with the consequences - and condemn others.

MS have made it clear that Windows 2000 will not ship before it's ready. They have said they will ship when customers tell them it's ready. You are the customer - tell MS what you've found out and what you think.

In general: Make a difference. File a GOOD bug report.

OK, Cool, so how do I do it.

If you are on an internal beta, you will know how to do this - it was on the release notes accompanying your CD (and in email). Please follow directions, and discuss the issue on the internal newsgroups. Please read those groups.

If you are not on the technical beta, then go to ntbeta.microsoft.com. Fill in a short survey, and give them your email alias. You will then get a userid and password to enter the site. Go back, and with your password, you can drill down to a web tool to file a bug report. Spend a bit of time, if you can, to look at the site for more details on bug reporting. Oh, and the ntbeta.microsoft.com has not been renamed. Yet.

In general: The ntbeta.microsoft.com site is your friend.

How much do I need to tell MS about a bug. How good is good?

To some degree, the more you can provide, the better. Filing good bug reports means report as much as possible, including all your hardware, the exact nature of problem, and if possible precise steps to reproduce it.

In general, If MS can't reproduce it - it's not a bug.

Written by that guy who is always asking folks to read the documentation, use Help, and file good bug reports.

And for the humour impaired: this entire post is classified ":-) "

Q. What hardware is needed to run Windows 2000?

A. Below is a list of the minimum hardware needed to install Windows 2000.

32-bit, Intel-based microprocessor computer (such as Pentium-compatible 166 MHz or higher) for both Windows NT Workstation and Windows NT Server.
VGA or higher resolution monitor
Keyboard
32 MB of RAM minimum (Windows NT Server: 64 MB of RAM)
Hard disk space with a minimum of 300 MB of free disk space for Windows NT Workstation. (Server: a minimum of 400MB of free disk space on the partition that will contain the Windows NT system files). Several factors affect free disk space required by Windows NT 5.0 Setup, including disk cluster size, amount of RAM in the system, and the file system used (For example, NTFS uses a smaller disk cluster size than FAT file systems) and network compared to local installations (which requires less free space). Setup determines if you have sufficient disk space to successfully complete the installation with the optional components you have selected.
For CD-only installation, a bootable CD-ROM drive (so you can start Setup without using a floppy disk drive)
For floppy disk and CD installation, a high-density 3.5-inch disk drive as drive A and a CD-ROM drive
For network installation, one or more network adapters installed on your computer and access to the network share containing the Setup files.
A mouse or other pointing device

The minimum memory is the minimum memory and setup program performs a test to check you have that amount or the installation will not proceed (very annoying when I tried to install server on my portable which (then) only had 32MB of RAM). You can hack the txtsetup.sif files, however, to install either Server or Workstation on systems with less memory. There is no check on CPU type.

The 64bit Alpha processor continues to be supported, although memory requirements are slightly larger (eg 96MB for Server) than Intel systems. Support for archaic 1st generation systems such as the Jensen has been dropped for Windows 2000.

This information is also in the file setup.txt on the Windows 2000 (NT 5.0 Beta) CD-ROM.

Q. Where is the Hardware Compatibility List for Windows 2000?

A. The HCL for Windows 2000 is supplied on the CD in both text and HTML Help format. It can also be found at ftp://ftp.microsoft.com/services/whql/win2000hcl.txt.

Q. How can a FAT partition be converted to an NTFS partition?

A. From the command line enter the command convert d: /fs:ntfs . This command is one way only, and you cannot convert an NTFS partition to FAT. If the FAT partition is the system partition then the conversion will take place on the next reboot.

After the conversion File Permissions are set to Full Control for everyone, where as if you install directly to NTFS the permissions are set on a stricter basis.

Q. How can a NTFS partition be converted to a FAT partition?

A. A simple conversion is not possible, and the only course of action is to backup all the data on the drive, reformat the disk to FAT and then restore your data backup.

Q. How do I run HPFS under NT 4.0?

A. If you want NT support for HPFS, you can upgrade from 3.51 to 4.0 which will retain HPFS support. You can manually install the 3.51 driver under NT 4.0, however this is not supported by Microsoft.

Copy the 3.51 pinball.sys to the NT 4.0 %SystemRoot%\system32\drivers directory.
Start the registry editor (regedit.exe)
Goto the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
From the Edit menu, select "New Key"
In the form entry box which appears, enter Pinball as the Key Name. Leave the class field blank, and click OK
Highlight the new Pinball key in the editor's left panel and select New Dword from the Edit menu
Enter a name of ErrorControl and click OK
Double click ErrorControl and set to "0x1"
Highlight Pinball again and select "New String" from the Edit menu with name "Group" click OK
Double click Group and set to "Boot file system"
Highlight Pinball again and select "New DWORD" from the Edit menu with name "Start" click OK
Double click Start and set to "0x1"
Highlight Pinball again and select "New DWORD" from the Edit menu with name "Type" click OK
Double click Type and set to "0x2"
Close the registry editor
Reboot the machine

Q. How do I compress a directory?

A. Follow instructions below (this can only be done on an NTFS partition)

Using Explorer or My Computer select a drive
Right click on a directory and choose properties
Select the "Compress" Check box and click "Apply"
You will be asked if you want to compress subdirectories, click OK
Click OK to exit

Q. How do I uncompress a directory?

A. Follow the same procedure above, but uncheck the compress box.

Q. Is there an NTFS defragmentation tool available?

A. There are a number available for NT that I know of.

Diskeeper - This is available from Executive Software, http://www.diskeeper.com. Diskeeper has the advantage of having a free full function version for download, Diskeeper Lite.
Norton Utilities for NT - This contains a disk defragmentation package, http://www.symantec.com
PerfectDisk NT - from http://www.raxco.com is also now on the market but I have not tried it.
O&O Defragmentation - can be purchased from http://www.oo-defrag.com/index-e.html which I have been informed works well.
VoptNT - is available from Golden Bow Systems, http://www.goldenbow.com

Windows 2000 has a limited built in defragmentation tool which can be used as follows:

Start the MMC (Start - Run - MMC)
From the console menu select Add/Remove Snap-in
Click Add
Select "Disk Defragmenter" and click Add. Click Close
Click OK to the main Add/Remove dialog
Select the Disk Defragmenter option from Console Root
Select a partition, Analyze and Defragment

Q. Can I undelete a file in NT?

A. It depends on the file system. NT has no undelete facility, however if the filesystem was FAT then boot into DOS and then use the dos undelete utility. With the NT Resource kit there is a utility called DiskProbe which allows a user to view the data on a disk, which could then be copied to another file. It is possible to search sectors for data using DiskProbe.

If the files are deleted on an NTFS partition booting using a DOS disk and using the undelete.exe program is not possible since DOS cannot read NTFS partitions. NTFS does not perform destructive deletes which means the actual data is left intact on the disk (until another file is written in its place) and so a new application from Executive Software, Network Undelete can be used to undelete files from NTFS partitions. A free 30-day version can be downloaded from http://www.networkundelete.com/.

Executive Software also have a free utility Emergency Undelete which can undelete locally deleted files, http://www.execsoft.com.

It is important that once any file is delete all activity on the machine is stopped to reduce the possibility of other files overwriting the data that wants to be recovered.

Q. Does NT support FAT32?

A. Native NT does not support FAT32. NT Internals have released a read-only FAT32 driver for Windows NT 4.0 from http://www.sysinternals.com/fat32.htm, or a full read/write version can be purchased from http://www.winternals.com.

Windows 2000 has full FAT 32(x) support with the following conditions:

Pre-existing FAT32(x) partitions up to 127GB will mount and be supported under Windows 2000.
Windows 2000 will only allow you to create new FAT32(x) volumes of 32gb or less.

Q. Can you read an NTFS partition from DOS?

A. Not with standard DOS, however there is a product called NTFSDos which enables a user to read from a NTFS partition. The homepage for this utility is http://www.sysinternals.com.

Q. How do you delete a NTFS partition?

A. You can boot off of the three NT installation disks and follow the instructions below:

Read the license agreement and press F8
Select the NTFS partition you wish to delete
Press L to confirm
Press F3 twice to exit the NT setup

Usually a NTFS partition can be deleted using FDISK (delete non-DOS partition), however this will not work if the NTFS partition is in the extended partition.

You can delete an NTFS partition using Disk Administrator, by selecting the partition and pressing DEL (as long as it is not the system/boot partition).

There is also a utility called delpart.exe that will delete a NTFS partition from a DOS bootup.

Q. Is it possible to repartition a disk without losing data?

A. There is no standard way in NT, however there is a 3rd party product called Partition Magic which will repartition FAT, NTFS and FAT32, however there is a bug in the product which makes the boot partition unbootable if it is repartitioned. A fix is available for this from their web site

Q. What is the biggest disk NT can use?

A. The simple answer to this question is that NT can view a maximum partition size of 2 terabytes (or 2,199,023,255,552 bytes), however there are limitations that restrict you well below this number.

FAT has internal limits of 4 GB due to thefact it uses 16-bit fields to store file sizes, 2^16 is 65,536 with a cluster size of 64 KB gives us the 4 GB.

HPFS uses 32bit fields and can therefore handle greater size disks, but the largest single file size is 4GB. HPFS allocates disk space in 512 byte sectors which can cause problems in Asian markets where sector sizes are typically 1024 bytes which means HPFS cannot be used.

NTFS uses 64-bits for all sizes, leading to a max size of..... 16 exabytes!!! (18,446,744,073,709,551,616 bytes), however NT could not handle a volume this big.

For IDE drives, the maximum is 136.9 GB, however for a standard IDE drive this is constrained to 528MB. The new EIDE drives can access much larger sizes.

It is important to note that the System partition (holding ntldr, boot.ini, etc.) MUST be entirely within the first 7.8Gb of any disk (if this is the same as the boot partition this limit applies) This is due to the BIOS int 13H interface used by ntldr to bootstrap up to the point where it can drive the native HDD IDE or SCSI. int 13H presents a 24 bit parameter for cylinder/head/sector for a drive. If say by defragmentation the system are moved beyond this point you will not be able to boot the system.

Q. Can I disable 8.3 name creation on a NTFS?

A. From the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem, change the value NtfsDisable8dot3NameCreation from 0 to 1.

You may experience problems installing Office 97 if you disable 8.3 name creation and may have to re-enable it during the installation of the software.

Q. How can I stop NT from generating LFN's (Long File Names) on a FAT partition?

A. Using the registry editor change the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\Win31FileSystem from 0 to 1 and only 8.3 file names will be created.

The reason for not wanting the LFN's to be created is that some 3rd party disk utilities that directly manipulate FAT can destroy the LFN's. Utilities such as SCANDISK and DEFRAG that come with DOS 6.x and above do not harm LFN's.

Q. I can't create any files on the root of a FAT partition.

A. The root of a FAT drive has a coded limit of 512 entries, so if you have exceeded this you will not be able to create any more files. I don't have this many! Remember Long File Names take up more than one entry, see the next FAQ for more information, so if you have many LFN's on the root this will drastically reduce the number of files you can have.

Q. How do LFN's work?

A. Long File Names are stored using a series of linked directory entries. A LFN will use one directory entry for its alias (the alias is the 8.3 name automatically generated), and a hidden secondary directory entry for every 13 characters in its name, so if you had a 200 character long file name, this would use 17 entries!

The alias is generated using the first six characters of the LFN, then a ~ and a number for the first 4 versions of a files with the same first six characters, e.g. for the file
john savills file.txt
the names generated would be johnsa~1.txt, johnsa~2 etc.

After the first 4 version of a file, only the first two characters of the file name are used, and the last 6 are generated, e.g. jo0E38~1.txt

Q. How do I change access permissions on a directory?

A. You can only set access permissions on an NTFS volume. Follow the instructions below:

Start Explorer (Start - Programs - Explorer).
Right click on a directory and select properties
Click on the Security tab
Click the permissions button
Enter the information required
Click OK, and then click OK again to exit

Q. How can I change access permissions from the command line?

A. A utility called CACLS.EXE comes as standard with NT, and can be used from the command prompt. Read the help with the CACLS.EXE program (cacls /?). To give user john read access to a directory called files enter:
CACLS files /e /p john:r
/e is used to edit the ACL instead of replacing it, therefore other permissions on the directory will be kept. /p sets permission for user:<permission>

Q. I have a CHKDSK scheduled to start next reboot, but I want to stop it.

A. If the command chkdsk /f /r (find bad sectors, recover information from bad sectors and fix errors on the disk) is run, on the next reboot the check disk is scheduled, however you may want to cancel this check disk. To do this perform the following:

Run the Registry Editor (Regedt32.exe). You must use Regedt32 and not Regedit.exe
Goto HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Change the BootExecute value from:
autocheck autochk * /r\DosDevice\<drive letter>:
To:
autocheck autochk *

Q. My NTFS drive is corrupt, how do I recover?

A. To restore an NTFS drive using the information below, it must have been created using Windows NT 4.0, if it was not created using NT 4.0 you should see Knowledge base article Q121517. To restore an NTFS partition you must locate the spare copy of the boot sector and copy it to the correct position on the drive. You need the NTdiskedit utility (you can also use Disk Probe that comes with the resource kit and instructions for Disk Probe can be found at http://support.microsoft.com/support/kb/articles/q153/9/73.asp or Norton disk edit) which is available from Microsoft Support Services.

Using NTdiskedit for Windows NT 4.0, on the File menu, click Open.
Type the Volume Name as
\\.\PhysicaldriveX
where X=the ordinal of the disk that appears in Disk
Administrator)
Click OK.
On the Read menu, click Sectors. Select 0 for Starting Sectors and select 1 for Run Length. Click OK.
On the View menu, click Partition Table. You should see a table that has four sections, Entry 0 through Entry 3. This refers to the order of partitions. If the partition in question is Partition 2 on the Disk, you need the data in Entry 1. If the Partition in question is the Partition 1 on the disk, you need the data from Entry 0 and so on.
Write down the values of Starting Sector and Sectors.
NOTE: all of the values you see will be in hexadecimal format. Do not convert to decimal.
Using a Calculator (you can use the one from the Accessories group if one is available) that can add hexadecimal numbers, add the values for Starting Sector and Sectors, and subtract 1 from the sum. For example:
STARTING SECTOR=Ox3F
SECTORS=0x201c84 +
----------
0x201CC3
Less 1 0x1 -
----------
Copy of NTFS bootsector=0x201CC2
On the Read menu, click Sectors. In Starting Sectors, type the value from the equation above. Type 1 in Run Length. Click OK.
You now should be at your copy of the NTFS bootsector. Visually inspect the boot sector for completeness, NTFS header at first line, text in the lower region (for example, "A kernel file is missing from the disk"), and so forth.
Click Relocate Sectors. This is the Sector you are going to write the bootsector. This will be the value of your Starting Sector with the Run Length of 1. Click OK.
Quit Ntdiskedit. Use Disk Administrator to assign a drive letter if not already assigned. Restart the computer; the file system should be recognized as NTFS.

Q. How can I delete a file without it going to the recycle bin?

A. When you delete the file, hold down the shift key.

Q. How can I change the serial number of a disk?

A. The serial number is located in the boot sector for a volume. For FAT drives its 4 bytes starting at offset 0x27; for NTFS drives its 8 bytes starting at offset 0x48. You'll need a sector-level editor to modify the number (like the Resource Kit's Diskprobe).

Q. How can I backup the Master Boot Record?

A. The Master boot record on the hard disk used to start the computer (the system partition) is the most critical sector so make sure this is the sector you backup. The boot partition is also very important (where %systemroot% resides). You need the DiskProbe utility that comes with the Resource Kit.

Start DiskProbe
From Drives, click Physical Drive, and click on the drive that is the system partition (from the Open Physical Drive dialog)
The disk clicked will be displayed in the Handle 0 section. Click "Set Active" and then click Close
From the sectors menu click Read. Accept the default sectors of "Starting Sector" 0, and "Number of Sectors" 1.
From the File menu click "Save As" and enter a file name.

Q. How do I restore the Master Boot Record?

A. Follow the instructions below, however be very careful!!!

Start DiskProbe
From "File" click "Open" and select the file that the information was saved as
From drives click Physical Drive and click the disk you want to replace the boot partition on
In the Handle 0 box, clear the Read Only box and click "Set Active", then click Close
From the sectors menu click write and set the starting sector to 0, and click "Write it"
Verify and close DiskProbe
Keep your fingers crossed :-)

Q. What CD-ROM file systems can NT read?

A. NT's primary file system is CDFS a read only file system, however it can read any file system that is ISO9660 compliant.

Q. How do I disable 8.3 name creation on VFAT?

A. Start the registry editor (regedit.exe) and set the value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem\Win95TruncatedExtensions to 0.

Q. How do I create a Volume Set?

A. A volume set allows you to take all the unused space on one or more drives (up to 32 drives per volume set) and combine it into a single, large, system recognizable drive. To create a volume set:

Logon as an Administrator and start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator).
Click on the first free area of disk space, then hold down the Ctrl key and select all the other areas of unpartitioned space.
Once all the parts are selected, from the Partition menu select "Create Volume Set".
A dialog box will be displayed and you can choose the size of the partition to be created. Click OK
Once created the areas that are part of a Volume Set will be shown in yellow.
Close Disk Administrator (or select Commit Changes New)
A confirmation dialog box will be displayed, confirm and a reboot will be required.
Once the reboot has completed you can now format the volume. You should really format the Volume NTFS, as DOS and Windows95 clients will not be able to read it anyway!

The main problem with volume sets is that if one drive in the volume set fails, the entire volume set becomes unavailable.

Q. How do I extend a Volume Set?

A. Extending a volume set is very simple, however a reboot will be required

Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator)
Click on the existing Volume Set and hold down the Ctrl key
Click on the area (or areas) of free space to be added (a black border will be shown around them)
Choose "Extend Volume Set" from the Partition menu, or right click on one of the selected areas and this option will be shown.
A dialog box will be shown asking how large the drive should be. Click OK
From the Partition menu, select "Commit changes now"
Answer the further dialogs and reboot the server.

The reboot will take longer than normal as the new area added has to be formatted to the same file system as the rest of the volume set.

Note: Only NTFS Volume Sets can be extended.

Q. How do I delete a Volume Set?

A. When you delete a volume set all the data stored will be lost. To delete a volume set:

Start Disk Administrator
Click on part of the volume set
Select Delete from the Partition menu
Click Yes on the dialog box

Q. What is the maximum number of characters a file can be?

A. This depends on if the file is being created on a FAT or NTFS partition. The maximum file length on a NTFS partition is 256 characters, and 11 characters on FAT (8 character name, . , 3 character extension). NTFS filenames keep their case, whereas FAT filenames have no concept of case (however the case is ignored when performing a search etc on NTFS). There is the new VFAT which also has 256 character filenames.

NTFS filenames can contain any characters, including spaces, uppercase/lowercase except for the following

" * : / \ ? < > |

which are reserved for NT, however the file name must start with a letter or number.

VFAT filenames can also contain any characters except for the following

/ \ : | = ? " ; [ ] , ^

and once again the file name must start with a letter or number.

NTFS and VFAT also creates a 8.3 format file name, see Q. How to LFN's work?

Q. How can I stop chkdsk at boot time from checking volume x?

A. When NT boots it performs a check on all volumes to see if the dirty bit is set, and if it is a full chkdsk /f is run. To stop NT performing this dirty bit check you can exclude certain drives. The reason you may want to do this is for some type of removable drive, e.g. Iomega drives:

Run the Registry Editor (Regedt32.exe). You must use Regedt32.exe and not Regedit.exe
Goto HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Change the BootExecute value from:
autocheck autochk *
to:
autocheck autochk /k:x *

Where x is the drive letter, e.g. if you wanted to stop the check on drive f: you would type autocheck autochk /k:f *. To stop the check on multiple volumes just enter the drive names one after another, e.g. to stop the check on e: and g: autocheck autochk /k:eg *, you do not retype the /k each time.

If you are using NT 4.0 with Service Pack 2 or above, you can also use the CHKNTFS.EXE command which is also used to exclude drives from the check and updates the registry for you. The usage to disable a drive is

chkntfs /x <drive letter>:
e.g. chkntfs /x f: would exclude the check of drive f:

To set the system back to checking all drives just type

chkntfs /d

Q. How can I compress files/directories from the command line?

A. A utility is supplied with the resource kit called compact.exe which can be used to view and change the compression characteristics of a file/directory.

Q. What protections can be set on files/directories on a NTFS partition?

A. When you right click on a file in Explorer and select properties (or select Properties from the File menu) you are presented with a dialog box telling you information such as size, ownership etc. If the file/directory is on a NTFS partition there will be a security tab, and within that dialog, a permissions button. If you press that button you can grant access to users/groups on the resource at various levels.

There are six basic permissions

R - Read
W - Write
D - Delete
X - Execute
P - Change Permissions
O - Take Ownership

These can be assigned to a resource, however they are grouped for ease of use

No Access - User has no access to the resource
List - R User can view directory and filenames in directory
Read - RX User can read files in directory and execute programs
Add - WX User can add files to the directory, but cannot read or change the contents of the directory
Add & Read - RWX User has read and add permissions
Change - RWXD User has read, add, change contents and delete files
All - RWXDPO User can do anything she wants!

The permissions above can all be set on a directory, however this list is limited for a file, and permissions that can be set are only No Access, Read, Change and Full Control.

Another permission exists called "Special Access" (on a directory there will be two, one for files, one for directories), and from this you can set which of the basic permissions should be assigned.

Q. How can I take ownership of files?

A. Sometimes you may want to take ownership of files/directories, usually as someone has removed all access on a resource and can't see it. You would log on as the Administrator and take ownership. You cannot give ownership to someone else using standard NT functionality, only take ownership.

Log on as Administrator or a member of the Admins group
Start Explorer
Right click on the file/directory and select properties
Select the Security tab and click Ownership
Click "Take Ownership" and then click Yes to the prompt

Q. How can I view the permissions a user has on a file from the command line?

A. A utility is supplied with the resource kit called perms.exe which can be used to view permissions on files/directories. The usage is

perms <domain>\<user> <file>
e.g. perms savilltech\savillj d:\file\john\file.dat

You can add /s to also show details of sub files/directories. The permissions shown equate to

R	Read
W	Write
X	Execute
D	Delete
P	Change Permission
O	Take Ownership
A	All
None	No Access
*	User is the owner
#	A group the member is a member of owns the file
?	Permissions cannot be determined

To output to a file just add > filename.txt at the end, e.g.

perms <user> <file> > file.txt

Q. How can I tell the total amount of space used by a folder (including sub folders)?

A. There are two ways of doing this (there are more!), one using explorer and one from the command line. Using Explorer

Start Explorer (Win key + E or Start - Programs - Explorer)
Right click on the required folder and select properties
Under the General tab a size will be displayed and this is the total size of the folder and all sub-folders and their contents.

From the command line you can just use the dir command with /s qualifier which also lists all sub-directories, e.g.
dir/s d:\savilltechhomepage
would list all files/folders in the savilltechhomepage directory and at the end the total size.

Q. There are files beginning with $ at the root of my NTFS drive, can I delete them?

A. NO!!! These files hold the information of your NTFS volume. Below is a table of all the files used by the file system:

$MFT	Master File Table
$MFTMIRR	A copy of the first 16 records of the MFT
$LOGFILE	Log of changes made to the volume
$VOLUME	Information about the volume, serial number, creation time, dirty flag
$ATTRDEF	Attribute definitions
$BITMAP	Contains drive cluster map
$BOOT	Boot record of the drive
$BADCLUS	A list of bad clusters on the drive
$QUOTA	Quota information (used on NTFS 5.0)
$UPCASE	Maps lowercase characters to uppercase version

If you want to have a look at any of these files use the command

dir /ah $mft

Its basically impossible to delete these files anyway as you can't remove the hidden flag and if you can't remove the hidden flag you can't delete it!

Q. What file system do Iomega ZIP disks use?

A. By default, the formatted ZIP disks are FAT, however you can format these with NTFS is you want. NTFS has a higher overhead than FAT on small volumes (an initial 2MB) which is why you don't have NTFS on 1.44 floppy disks.

Q. What cluster size does a FAT/NTFS partition use?

A. The default cluster size for a FAT partition is as follows:

Partition size	Sectors per cluster	Cluster size
<32MB	1	512 bytes
<64MB	2	1K
<128MB	4	2K
<255MB	8	4K
<511MB	16	8K
<1023MB	32	16K
<2047MB	64	32K
<4095MB	128	64K

This is why FAT volumes larger than 511MB are not recommended due to the amount of potentially wasted space due to the 16KB and above cluster size.

The default for NTFS is as follows:

Partition size	Sectors per cluster	Cluster size
<512MB	1	512 bytes (or hardware sector size if greater than 512 bytes)
<1024MB	2	1K
<2048MB	4	2K
<4096MB	8	4K
<8192MB	16	8K
<16384MB	32	16K
<32768MB	64	32K
>32768 MB	128	64K

NTFS better balances the trade off between disk defragmentation due to smaller cluster size and wasted space due to a large cluster size.

When formatting a drive you can change the cluster size using the /a:<size> switch, e.g.

format d: /a:1024 /fs:ntfs

Q. How much free space do I need to convert a FAT partition to NTFS?

A. The calculation below can be used for disks of a standard 512 bytes per sector:

Take the size of the partition and divide by 100. If this is less than 1,048,576 use 1,048,576, if greater than 4,194,304 use 4,194,304
Add to the number calculated above the size of the partition divided by 803
Add to the number calculated the total number of files and directories multiplied by 1280. You can work out the total number of files and directories using the dir /s command at the base of the partition, e.g.
dir /s d:\
Total Files Listed:
3397 File(s) 300,860,372 bytes
Add to the above 196096

To summarize:

Free space needed = (<size of partition in bytes>/100) + (<size of partition in bytes>/803) + (<no of files & directories> * 1280) + 196096

For more information see Knowledge Base article Q156560 at http://support.microsoft.com/support/kb/articles/q156/5/60.asp

Q. NT becomes unresponsive during an NTFS disk operation such as a dir.

A. When you perform a large NTFS disk operation such as a dir/s *.* or a ntbackup :\*.* NT can sometimes become unresponsive because NT updates NTFS files with a last access stamp and if viewing thousands of files the NTFS log file can become full and waits to be flushed to the hard disk, this can cause NT to become unresponsive. To stop NTFS updating the last access stamp perform the following:

Start the registry editor (regedit.exe)
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem
From the Edit menu select New - DWORD value
Enter a name of NtfsDisableLastAccessUpdate and click OK
Double click the new value and set to 1. Click OK
Close the registry editor
Reboot the machine

This should improve the performance of your NTFS partitions.

Below is an example or a .reg file that can be used to automate this:

REGEDIT4 ; [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem] "NtfsDisableLastAccessUpdate"=dword:1

Q. I have missing space on my NTFS partitions (Alternate Data Streams).

A. Its possible to hide data from both explorer and the dir command within an NTFS file that you cannot see unless you know its stream name. NTFS allows multiple streams to a file in the form of <filename>:<stream name>, you can try it

Start a console windows (cmd.exe)
Run "notepad normal.txt" and enter some text and save. This has to be on an NTFS partition
Now edit the file again but this time with a different stream "notepad normal.txt:hidden". You will be prompted to create a new file. Enter some text and save
Perform a dir and you will see you still see only normal.txt with its original size.

You can have as many streams as you want. If you copy a file it keeps the streams, so copying normal.txt to john.txt, john.txt:hidden would exist. You cannot use streams from the command prompt as it does not allow : in files names except for drive letters.

Microsoft provide no way of detecting or deleting these streams. The two ways to delete are

Copy the file to a FAT partition and back again
- ren <file> temp.exe
- cat temp.exe > <file>
- del temp.exe

One application I have found to detect alternate data steams is by Frank Heyne and can be downloaded from http://www.heysoft.de/nt/ep-lads.htm .

Alternatively you can use Lizp which is downloadable from http://www.lizp.com. I have not used it in earnest, however what I have seen looks very good. An example use would be

Lizp NT use

Its also possible to write a function to enumerate every altstream in every file matching c:\winnt\*. To do this, let's define a function, we'll call it las, and it'll take one argument, the wild path. Then we could type
(las 'c:\winnt\*)
and we'd get what we wanted.

Here's such a function definition:

(sequence
 (define
 (las Dir)
 (filter
 '(lambda
 (o)
 (cdr o) )
 (mapcar
 '(lambda
 (FileInfo)
 (if
 (getfilesize
 (car FileInfo) )
 (cons
 (car FileInfo)
 (getaltstreams
 (car FileInfo) ) )
 (cons nil nil) ) )
 (dirlist Dir) ) ) )
 '(Enhanced with las) )

Even though you could type all this in at the prompt, on one long line, it's easier to save the code above to a file. Let's call the file las.lzp.

Now, from the Lizp prompt, you could type

(eval (load 'las.lzp))

and voila, you'll have a new function, las. Now try the thing above:

(las 'c:\winnt\*)

Suppose we think our Lizp should have this functionality always. Then type

(Compile (load 'las.lzp) 'Lizp_with_las.exe true)

and we'll have a new version of Lizp, called Lizp_with_las.exe.

Finally, suppose we wanted a GUI application which asked us for the wild path, and then displayed the alternate streams in a window. Save the following lines to a file, let's call it las_gui.lzp:

(local
 (Result)
 (setq Result
 (las
 (inputbox
 '((Wild path to check for Alt Streams)) ) ) )
 (messagebox
 (if Result Result
 '((No Alt Streams found in path.)) ) )
	(exit) )

Now, from Lizp_with_las' prompt, type

(Compile (load 'las_gui.lzp) 'Las.exe nil

and you'll have a new program, Las.exe, doing what we want. Note the last argument to the Compile function: the first time we compiled, we used "true", this last time we used "nil". This is because the first time we wanted the new program to create a console when run (because it was going to be our new Lizp interpreter). The second time we don't need a console.

Another way to delete these streams is to edit them in notepad and delete all the text. When you quit notepad NT tells you that the file is empty and will be deleted and you only have to confirm.

If you want to write your own programs to detect streams have a look at

Basically the only reliable way of handling streams is to use the BackupRead() function. The only "problem" is that BackupRead() requires SeRestorePrivilege/SeBackupPrivilege rights which most users will not have

BackupRead() actually does is to turn a file and its associated metadata (extended attributes, security data, alternate streams, links) into a stream of bytes. BackupWrite() converts it back.

Q. How can I change the Volume ID of a disk?

A. Windows NT provides functionality to change the volume name of a disk by using the command

label <drive>: <label name>

Windows NT does not provide built in functionality to change Volume ID's, however NT Internals has produced a free utility that can be downloaded from http://www.sysinternals.com/misc.htm called VolumeID which can change the volume ID of a FAT or NTFS volume. To view a drives current Volume ID you can just perform a dir <drive>: and the volume serial number is shown on the second line down, e.g.

Volume in drive E is system
Volume Serial Number is BC09-8AE4

To change enter the command

volumeid <drive letter>: xxxx-xxxx

Q. How do I read NTFS 5.0 partitions from Windows NT 4.0?

A. Service Pack 4 includes a read/write driver for NTFS 5.0 volumes (an updated ntfs.sys driver). More details will follow once Service Pack 4 is released, the non-disclosure agreement limits me from saying any more.

Q. How do share and file system protections interact?

A. In general when you have protections on a share or on a file/directory the privileges are added, for example if user John was a member of 2 groups, one with read access and another with change the user would have read and change access. The exception to this if a group has "no access" which means no mater what other group memberships there are, any user in that group will have no access.

The opposite is true when protections are set on the file system and on the share where the most restrictive policy is enforced, e.g. if the file has full control set for a user and the share only has read then the user will be limited to read-only privileges, likewise if the file had only read-only but the share had full the user would still be limited to read-only.

Share protections are only used when the file system is accessed through a network connection, if the user is using the partition locally then the share protections will be ignored.

Q. How can I backup/restore my Master Boot Record?

A. The Windows NT Resource kit supplies a utility DISKSAVE.EXE which enables a binary image of the Master Boot Record (MBR) or Boot Sector to be saved.

DISKSAVE has to be run from DOS and so you will need to create a bootable DOS disk and copy DISKSAVE.EXE to the disk. To create a DOS bootable disk just use the command

C:\> format a: /s

from a DOS machine (do not do it from a Windows NT command session).

Once you boot with the disk you will have a number of options:

F2 - Backup the Master Boot Record - This function will prompt for a path and filename to save the MBR image to. The path and filename are limited to 64 characters. The resulting file will be a binary image of the sector and will be 512 bytes in size. The MBR is always located at Cylinder 0, Side 0, Sector 1 of the boot disk.

F3 - Restore Master Boot Record - This function will prompt for a path and filename for the previously save Master Boot Record file. The only error checking is for the file size (must be 512 bytes). Copying and incorrect file to the MBR will permanently destroy the partition table information. In addition, the machine will not boot without a valid MBR. The Path/filename is limited to 64 characters.

F4 - Backup the Boot Sector - This function will prompt for a path and filename to save the Boot Sector image to. The path and filename are limited to 64 characters. The resulting file will be a binary image of the sector and will be 512 bytes in size. The function opens the partition table, searches for an active partition, then jumps to the starting location of that partition. The sector at that location is then saved under the filename the user entered. There are no checks to determine if the sector is a valid boot sector.

F5 - Restore Boot Sector - This function will prompt for a path and filename for the previously save Boot Sector file. The only error checking is for the file size (must be 512 bytes). Copying and incorrect file to the Boot Sector will permanently destroy Boot Sector information. In addition, the machine will not boot without a valid Boot Sector. The Path/filename is limited to 64 characters.

F6 - Disable FT on the Boot Drive - This function may be useful when Windows NT will not boot from a mirrored system drive. The function looks for the bootable (marked active) partition. It then checks to see if the SystemType byte has the high bit set. Windows NT sets the high bit of the SystemType byte if the partition is a member of a Fault Tolerant set. Disabling this bit has the same effect as breaking the mirror. There is no provision for re-enabling the bit once it has be disabled.

Q. How do I convert an NTFS partition to NTFS 5.0? - NT 5.0 only

A. Windows NT 5.0 introduces NTFS 5.0 which enables a number of new features. By default when you install Windows NT 5.0 it will automatically convert any NTFS 4.0 partitions to NTFS 5.0 (however this may change).

Service Pack 4 has an updated NTFS.SYS which can read NTFS 5.0 partitions so apply this to any systems that need to read Windows 2000 NTFS 5.0 partitions.

To check the version of an NTFS partition use the CHKNTFS.EXE utility.

C:\> chkntfs <drive>: The type of the file system is NTFS 5.0.orThe type of the file system is NTFS 4.0 <drive>: is not dirty

If the file system is not NTFS 5.0 and you want to upgrade it use the command

C:\> chkntfs /e <drive>:

The machine will need to be rebooted for the upgrade to take place.

Q. I cannot compress files on an NTFS partition.

A. If when you try and compress files on an NTFS partition using Explorer (right click on a file/directory, select properties and check the compress box) the option is not available or when you try from the command prompt using the command:

C:\> compact /c ntfaq.txt /s

you get the error

"The file system does not support compression"

the cause is normally that the cluster size of the NTFS partition is greater than 4096. To check the cluster size of your NTFS partition use the CHKDSK command, e.g.

C:\> chkdsk <disk>: /i /c

The /i /c are used to speed up the chkdsk and at the end of the display it will tell you the bytes in each allocation unit:

2048 bytes in each allocation unit. 1012032 total allocation units on disk. 572750 allocation units available on disk.

If this number is greater than 4096 you will need to backup all the data on the disk and then reformat the partition using any of the following methods:

Start Explorer, make sure the partition is not being used, right click on the partition and select format. Set the allocation unit size to 4,096 or less
Start Disk Administrator (Start - Programs - Administrative Tools - Disk Administrator), right click on the partition, select format and again set the unit size to 4,096 or less
Format from the command prompt
C:\> format <drive>: /fs:ntfs /a:4096

Once reformatted you can then restore your backed up data.

To understand more about the 4,096 limit please read Knowledge base article Q171892 at http://support.microsoft.com/support/kb/articles/q171/8/92.asp

Q. How can I modify the CHKDSK timer?

A. Service Pack 4 introduces a new feature which before performing a chkdsk of a disk if its dirty bit is set a 30 second countdown timer is given allowing you to cancel to chkdsk from running.

If you want to modify this 30 second value perform the following:

Start the registry editor
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
From the Edit menu select New - DWORD Value. Enter a name of AutoChkTimeOut and press ENTER
Double click this new value and set to 0 to disable the timer, or the time in seconds you wish to be given to cancel the chkdsk.
Close the registry editor

The change will take effect at the next reboot

Q. How can I view the current owner of a file?

A. The normal method would be to right click on the file in Explorer, select Properties, click the Security tab and click Ownership. This will then show the current owner and give the option to take ownership.

To view from the command line you can use the SUBINACL.EXE utility that is shipped with the Windows NT Resource Kit Supplement 2. To view the current owner use as follows:

C:\> subinacl /file <file name> //++++ // D:\Documents\<file name> //---- + Owner = builtin\administrators + Primary Group= lnautd0001\domain users + System ACE count =0 + Disc. ACE count =1 lnautd0001\saviljo ACCESS_ALLOWED_ACE_TYPE FILE_ALL_ACCESS

You could perform on *.* to list owners for all files in all subdirectories (no need for any /s switch).

Q. How can I view/defrag pagefile fragmentation?

A. System Internals has released PageDefrag, a free utility that shows fragmentation in the pagefile and then offers the option of defragmentation at boot time.

The utility can be downloaded from http://www.sysinternals.com/pagedfrg.htm. Once you download just unzip the file and run pagedfrg.exe. Below is a sample output.

Pagedfrg.exe

I understand that Executive Software's Diskeeper 4.0 can also defragment pagefiles however I have not seen it in action (http://www.diskeeper.com).

Q. I get a disk maintenance message during setup.

A. If during setup up get the message:

Setup has performed maintenance on your hard disk(s) that requires a reboot to take effect. You must reboot and restart Setup to continue.

Press F3 to reboot.

This is returned when the Autochk part of the installation was able to repair the partition, but will require a reboot.

For a FAT partition, this could include corruption of extended attributes was fixed, the dirty bit was cleared, orphaned long filename entry was fixed (or any other fixing of lfns), directory entry fixed, crosslinked files fixed, non-unique filename uniqued, or any other structural issues at all fixed. There will of course be other specific "fixing steps" that would cause this for NTFS, or other non-file system specific structures.

In short this is not a problem as long as the setup does not get stuck in a loop keep running this stage.

Q. Where is Disk Administrator in Windows 2000? - Windows 2000 only

A. As with every other Administration tool in Windows 2000, Disk Administrator has been replaced with a Microsoft Management Console (MMC) snap-in.

By default it is accessible via the Computer Management MMC snap-in

Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
Select the Storage branch
Select Disk Management
Should look familiar

Disk Management MMC

Alternatively create your own MMC console

Start the MMC (Start - Run - MMC)
Select "Add/Remove Snap-in" from the Console menu
Click Add
Select Disk Management and click Add
Select Local Computer and click Finish
Click Close
Click OK to the main dialog

You now have your own MMC with just the Disk Management. You could save by selecting "Save As" from the Console menu, enter "Disk Admin" as the name and click Save. You will now see under the Programs menu a new folder, My Administrative Tools with Disk Admin as a MMC snap-in.

Q. How do I convert a basic disk to dynamic? - Windows 2000 only

A. Windows 2000 introduces the idea of a dynamic disk needed for fault tolerant configurations. To convert perform the following:

Start Computer Manager
Expand Storage - Disk Management.
Right click on the disk and select 'Upgrade to Dynamic Disk'
Select the disks to upgrade and click OK
A summary will be displayed.
Click Upgrade
Click Yes to the confirmation

Converting Basic disks to Dynamic disks don't require reboots - however any volumes contained on them after the conversion will generate a popup that basically says a re-boot is necessary before the volumes can be used. I generally say - NO, do not reboot - until all the volumes are identified and all the popups go away, then perform a single re-boot.

When you upgrade from basic to dynamic any existing partitions become simple volumes. Any existing mirrored, striped or spanned volumes sets created with NT 4.0 become dynamic mirrored, striped or spanned volumes respectively.

If you get a message that says you are out of space then you may not have enough unallocated free space at the end of the disk for the private region database that Dynamic disks use to keep volume information. To be Dynamic it needs about 1 MB of this space, sometime the space is not visible to the user in the GUI but it is still there.

You may not have the space if the partition(s) on the disk take up the entire disk and were created with Setup, an earlier version of NT or another OS. If partitions are created within Windows 2000 the space is reserved, partitions created with Setup will reserve the space in a later release.

To undo this conversion run Dmunroot.exe which will revert boot and system partition back to basic but all other volumes will be destroyed. Alternatively you should backup any data on the disk you wish to preserve, then delete all partitions - that should activate the menu choice "Revert to Basic Disk", the entire disk HAS to be unallocated or free space.

Q. How do I delete a volume in Windows 2000?

A. To delete a volume just perform the following, be warned you will lose any data on these volumes.

Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
Expand the Storage branch and select 'Disk Management'
Right click on the volume to be deleted and select 'Delete Volume..' from the context menu shown
Click Yes to the confirmation

Q. How do I import a foreign volume in Windows 2000?

A. If you take a disk from another machine and place in a Windows 2000 box it will be shown as foreign and its partitions not available, however its partition information can be imported and volumes used. Any volumes that were part of a set will be deleted during the import phase unless the whole set of disks are imported.

Start the Computer Management MMC (Start - Programs - Administrative Tools - Computer Management)
Expand the Storage branch and select 'Disk Management'
Right click on the volume to be imported and select 'Import Foreign Disks..' from the context menu shown
Click OK to the displayed dialog of the disk to import. If you imported multiple disks they will be grouped by the computer they were moved from and can be selected by clicking the 'Select Disk' button. If the disks imported are not dynamic they will all be imported regardless of you choices.
A dialog will be shown showing the volumes to import. Click OK

Notice the partition that was part of a RAID 5 set is not usable.

The data on the imported volumes will now be accessible (you have to refresh in Explorer to see them (press F5)).

Q. How can I wipe the Master Boot Record?

A. The normal method is using the DOS FDISK command:

C:\> fdisk /mbr

however there are some cases where this does not work and a more direct method may be needed.

A program called DEBUG.EXE is supplied with DOS, Windows 9x and NT and can be used to run small Assembly language programs and just such a program can be used to wipe the MBR. Perform the following, but BE CAREFUL, this WILL wipe your MBR leaving your system unbootable and its data lost.

Boot to 9x or DOS (this cannot be done from NT since direct disk access is not allowed)
Start a command prompt
Enter the following commands (in bold):
C:\> debug -F 9000:0 L 200 0 -a 0C5A:0100 Mov dx,9000 0C5A:0103 Mov es,dx 0C5A:0105 Xor bx,bx 0C5A:0107 Mov cx,0001 0C5A:0109 Mov dx,0080 0C5A:010A Mov ax,0301 0C5A:010D Int 13 0C5A:0110 Int 20 <press Enter twice> -u 100 L 12 <check the code matches the above> -g <executes> Program terminated normally -quit

You can now install a replacement MBR via a normal installation.

Thanks to Mark Minasi for giving permission to reproduce this Assembler code and a full explanation can be found in Windows NT Magazine Summer 1999 issue

Q. How can I cancel a scheduled NTFS conversion?

A. If you have scheduled a NTFS conversion for next reboot using the CONVERT command it can be canceled as follows:

Start the registry editor (regedt32.exe NOT regedit.exe)
Move to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager
Double click BootExecute
Change from
autoconv \DosDevices\x: /FS:NTFS
to:
autocheck autochk *
Click OK
Close the registry editor

Q. What is Distributed File System?

A. Distributed File System (or Dfs) is a new tool for NT server that was not completed in time for inclusion as part of NT 4.0, but is now available for download. It basically allows Administrators to simulate a single server share environment that actually exists over several servers, basically a link to a share on another server that looks like a subdirectory of the main server.

This allows a single view for all of the shares on your network, which could then simplify your backup procedures as you would just backup the root share, and Dfs would take care of actually gathering all the information from the other servers across the network.

You do not have to have a single tree (Dfs directory structures are called trees), but rather could have a separate tree for different purposes, i.e. one for each department, but each tree could have exactly the same structure (sales, info. etc).

For more information on DFS see http://www.microsoft.com/ntserver/nts/downloads/winfeatures/NTSDistrFile/AdminGuide.asp

Q. Where can I get Dfs?

A. Dfs is available for download from Microsoft http://www.microsoft.com/ntserver/nts/downloads/winfeatures/NTSDistrFile/default.asp. Follow the instructions at the site and fill in the form about your site. The file you want for the I386 platform is dfs-v41-i386.exe.

Once downloaded just double click on the file, and agree to the license. It will then install files to your drive which you need to install.

Q. How do I install Dfs?

A. Follow the instructions below, you must have first downloaded and expanded the file dfs-v40-i386.exe:

Right click on Network Neighborhood and select properties (or double click Network in the Control Panel)
Click the services tab and click Add
Click the "Have disk" button and when asked where enter %systemroot%/system32/dfs. Do not actually type %systemroot%, but rather what it points to, i.e. d:\winnt, so the full path would be d:\winnt\system32\dfs
Click Enter and press OK for Dfs installation
A dialog box will be shown, and click "New Share", and type the name of the required root, e.g. c:\dfsroot and click "Yes" to create the directory
Select the "Shared As" and fill in required information and click OK
Close the dialogs and reboot the machine

Q. How do I create a new folder as part of the Dfs?

A. Once Dfs is installed a new application, the Dfs Administrator, is created in the Administrative Tools folder. This app should be used to manage Dfs. To add a new area as part of the Dfs tree follow the procedures below:

Start the Dfs Administrator application (Start - Programs - Administrative Tools - Dfs Administrator)
Select "Add to Dfs" from the Dfs menu
Enter the name of folder you want an existing share to be known as
Next select what it should point to, you can either type the path, or use Browse.
Click Add
Close the Dfs Administrator

Q. How do I uninstall Dfs?

A. Follow the procedure below:

Start the network control panel applet or right click on Network Neighborhood and select propertied
Click the Services Tab
Select "Distributed File System" and click remove
You will be prompted to continue, click Yes
A reboot will then be required

Q. How do I assign User Rights for a standalone server (not the PDC/BDC) in a domain?

A. In NT Workstation, User Manager/Policies/User Rights... assigns the privileges (e.g. the Shutdown or Log On Locally privilege) for the local machine. However, in NT Server the User Rights you assign with User Manager for Domains affect the Domain Controller(s). To modify privileges for the local machine, first choose Select Domain... from the User menu, and type in the name of the computer at the Domain prompt (you cannot browse the domain).

Q. I can't FTP to my server, although the FTP service is running?

A. Have you unchecked the "Allow only anonymous connections" option, but still receive a "530 User xyz cannot log in. Login failed." message? To log on to the FTP server with your domain account, it is not sufficient to specify your name at the User prompt. The FTP service checks local accounts only, even if the computer is participating in a domain. Use domainname\username instead, e.g. if the domain name was savilltech and the user was john, enter savilltech\john as the username.

Q. How do I validate my NT Logon against a UNIX account?

A. There is software to do this available at

Q. Can I synchronize the time of a NT Workstation with a NT Server?

A. Yes, enter the command

NET TIME \\<name of the server to set time to> /SET /YES

Please note that users will require "Change System Time" user right, via User Manager\User rights. There is a utility on the resource kit called TimeServ which runs the time synchronization as a service and works even when there are no logged on users.

Also see Q. How do I configure a user so it can change the system time?

Q. How can I send a message to all users?

A. Ensure the "Messenger" service is started (Control Panel - Services - Messenger - Auto). To send a message type:
c:> net send <machine name> "<message>"
Or instead of a machine name type * to broadcast to all stations

There are also various GUI utilities, and one of the best is NT Hail at http://www.geocities.com/SiliconValley/Bay/1999/NT_Hail.html

Q. How do I change a Workstations Name?

A. Follow the steps below

Logon to the NT server and in Server Manager add the new computer name (Computer - Add to Domain)
On the Workstation from Control Panel double click Network (or right click on Network Neighborhood and select properties)
Click Change and type the new computer name
Press OK and accept reboot
The machine should then reboot with the new name
On the NT server you should now delete the OLD computer name (select and press DEL)

Q. How do I stop the default admin shares from being created?

A. This can be done through the registry.

Start the registry editor
Move to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters
If you are using Workstation create a value (Edit - Add Value) called AutoShareWks (AutoShareServer for server) of type DWORD and press OK. It will ask for a value, type the number 0.
Close the registry editor
Reboot

This can also be done using the policy editor. Start the policy editor (poledit.exe), load the default computer profile, and expand the Windows NT Network tree, then Sharing and set "Create hidden drive shares" to blank for server/workstation.

There are a few other options though. The first is to use NTFS and set protections on the files so people may be able to connect to the share, but they will not be able to see anything. The second is to delete the shares each time you logon, this can be done through explorer, but it would be better to have a command file run each time with the lines
net share c$ /delete
and for all the other shares, however these shares are there for a reason so your machine can be administered by the servers, so if you delete them system managers may have something to say about it!

Q. How do I disconnect all network drives?

A. Use net use * /del /yes

Q. How do I hide a machine from Network Browsers?

A. Using the registry editor set the key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters and set value Hidden from 0 to 1. You should then reboot. You can also type

net config server /hidden:yes

You can still connect to the computer, but it is not displayed on the browser.

Q. How do I remote Boot NT?

A. NT does not support remote boot. It is possible to reboot a machine from another computer using the Shutdown Manager that comes with the NT resource kit.

You could also reboot by using the shutdown.exe resource kit utility and specify another machine name.

C:\>shutdown \\<machine name> /r /y /c

Software such as PC Anywhere can also remotely reboot machines.

Q. How can I get a list of users currently logged on?

A. Use the net sessions command, however this will only work if you are an Administrator. You can also use control panel and choose server.

The resource kit utility, Net Watch, can also show current logged on users that are connected to the Netlogon share if you connect to the domain controller, however these connects terminate after a finite amount of time so will not necessarily show all users.

Q. How do I configure NT to be a gateway to an ISP?

A. Firstly the hardware required would be a network and a modem. The network card would be so the other clients in the network can communicate with the "to be" gateway, and the modem to connect to the gateway. Dial-up networking is not covered here, and you should first be confident with dial-up networking before attempting this.

Start the registry editor (regedit.exe) and add a value of type DWORD called DisableOtherSrcPackets in the HKey_Local_Machine\System\CurrentControlSet\Services\RasArp\Parameters area, and set to a value of 0. This is so packets that are sent through the NT gateway, the original IP address stored in each packet is retained, i.e. of machine a is sending a packet through b, then the packet retains the IP address of a, rather then be automatically changed to b. Also change HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\IPEnableRouter to a value of 1.
On the gateway machine ensure TCP/IP is installed with a static IP address, and a correct subnet address (usually 255.0.0.0 for a class a, 255.255.0.0 for class b, and 255.255.255.0 for class c). Make sure the default gateway address is blank.
Install Dial Up networking and configure for NT to dial out only. You will have to reboot
Add a phonebook entry for your ISP as you would as normal, however uncheck the "Use default gateway".
Enable the PC to be able to forward IP packets, by starting control panel, double click Network and choose the protocols tab. Select TCP/IP and then routing. Check the Enable IP Forwarding. You will need to reboot
If when you connect to your ISP you are given an IP address, you will need to connect to your ISP, and then find out which IP address you are given. To get the address type
IPCONFIG
Look for a Wan adapter and write down the IP address. If you know your IP address before you connect you can forget this step.
Add a route for the IP address used when connecting to the ISP (the one identified in step 6)
route add 0.0.0.0 mask 0.0.0.0 <ip address> metric 2
Configure all clients gateway as the network card IP address of the NT gateway.

This would enable the machines to send out IP packets to the internet, however the packets would have no way of finding there way back, as the ISP would not know to route them through the gateway, so you ISP will have to either a) have host entries for each of the machines or b) point to the gateway as another DNS.

Other things to check are as follows:

Make sure your ISP routes packets to you otherwise you will be able to send packets out but the replies will never be get to you
Make sure your local IP networks (each machine can ping each other) and that all PC's have a valid internet address. If you do not have internet addresses for each PC that have been assigned from InterNic then you will need something like Proxy Server instead.

Have a look at http://support.microsoft.com/support/ntserver/serviceware/nts40/e9mslcs1z.asp for more information.

Q. How do I install the FTP server service?

A. In prior version of NT, the FTP server service was installed as part of TCP/IP, however as of NT 4.0, it became part of IIS/PWS, so it needs to be installed manually. Before you install the FTP server, TCP/IP must be installed.

In Control Panel, double-click Network.
Click Services, click Add, and then click Microsoft Peer Web Services if you are using NT Workstation or click Microsoft Internet Information Server 2.0 if you are using NT Server.
Click OK, and then type the path for the Windows NT source files. For example, if you are using the Windows NT CD-ROM in drive E, type the following line: E:\i386
Click OK to start the Microsoft Peer Web Services Setup or Internet Information Server.
The FTP Service is selected by default, but you should clear the check boxes for options you do not want to install.

Q. How do I get a list of all connections to my PC?

A. Use the command netstat -a

Q. How can I get the Ethernet address of my Network card?

A. Type ipconfig /all from a command box.

Q. How can I configure the preferred Master Browser?

A. On the NT server you want to be the preferred master browser change the registry setting HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\IsDomainMaster to True

Q. Is it possible to protect against Telnet attacks?

A. There was a recent well-known problem that a telnet client could connect to an NT machine on port 135, type 10 characters and it would hang NT. There is no simple way to protect NT from a certain port attack. It is possible to configure NT to only accept incoming packets from a set of configured ports, however you have to name the ports you want to accept input from:

From Control Panel, Double click on Network
Click the Protocols tab
Select TCP/IP and click Properties
Click Advanced (bottom right)
Check the "Enable Security" and click configure
For TCP select "Permit Only" and enable only the ports you want to work (e.g. Web Browser is 80, FTP 21)
Exit
Reboot NT

To protect against the port 135 attack, install the RPC hotfix for Service Pack 2.

Service Pack 3 and some its Hotfixes are also highly desirable, and address a number of Internet attack methods.

Q. What Telnet Servers/Daemons are available for Windows NT?

A. A Telnet Server on NT allows connection to an NT machine using a Telnet client from any hardware platform. Products are available from:

http://www.ataman.com
http://www.georgiasoftworks.com
http://www.hummingbird.com/realindex.html
http://www.pragmasys.com
http://www.seattlelab.com
There is a beta version of a Telnet Server on the resource kit, and an updated oemsetup.inf is available from ftp://ftp.microsoft.com/bussys/winnt/winnt-public/reskit/nt40/telnetd/oemsetup.inf which fixes an installation problem.

Q. How do I install MSN under NT?

A. The new MSN 2.0 only runs under Windows 95, however a version for NT 4.0 is being developed. In the mean time it is possible to use MSN to connect to the Internet, however you cannot read Mail

Phone Microsoft and request for a manual Internet PPP access to be setup.
Assuming RAS is already installed, select Add New phonebook entry
Type in a name for the phone book entry, e.g. "MSN connection"
Clear the "I know about phone book entries" and click Next
Check "I am calling the Internet" and click Next
Click Finish
Select your new "MSN" and click Edit from More
Click the Server tab, and select TCP/IP, Enable PPP LCP, and clear NetBEUI and IPX
Click the TCP/IP settings box and check "Server assigned IP addresses" and "Use default gateway"
Click OK and exit back to the main dial screen
Select MSN and click Dial
When prompted for username/password enter
Username : MSN/<user name>
Password : <MSN password>
Domain : <blank>

Q. What FireWall products are available for NT?

A. Below are a selection of FireWall systems for NT:

FireWall/Plus from ht

	8.576.002	Kostenlose Z�hler
In memoriam C-BIT Information-Center Hannover (2.241/1075+2.241/1076 - no longer active)

Sicherheitshinweis: Wir weisen vorsorglich darauf hin, dass wir bei der Anmeldung saemtliche automatisch uebermittelten Parameter wie IP-Adresse und/oder Einwahlrufnummer speichern, um uns und unsere Kunden vor Missbrauch zu schuetzen. Selbstverstaendlich werden wir bei Bedarf umgehend strafrechtliche Massnahmen ergreifen, um einen vorliegenden Missbrauch zu ahnden.

What's New

Monday 7 June

Thursday 3 June

Wednesday 2 June

Tuesday 1 June

Monday 31 May

Service Pack 4

Service Pack 3

Service Pack 2

Service Pack 1

THOMAS'S TOP 10 FAQ TIPS FOR NT5 BETA 2