Geoff Chappell, Software Analyst
Each new marketing name for a Windows package brings at least a change of the minor version number for the kernel until contemporaneous client and server editions are reunited for version 6.0:
|3.10||Windows NT 3.1|
|3.50||Windows NT 3.50|
|3.51||Windows NT 3.51|
|4.0||Windows NT 4.0|
|5.2||Windows Server 2003|
Windows Server 2008
Windows Server 2008 R2
See that version numbering and product identification have been loose from the very start. Given a kernel whose version resource gives 3.10 as the Product Version but which contains the text “Microsoft (R) Windows NT (TM) Version 3.1”, is the product properly called Windows NT 3.10 or Windows NT 3.1? The corresponding text in a later build is “Microsoft (R) Windows NT (TM) Version 3.50” but a README.TXT file on the distribution discs announces “Microsoft Windows NT 3.5 Workstation and Server”.
It is not often enough appreciated enough that although Windows XP and Windows Server 2003 were largely contemporaneous, they were significantly different at kernel-level. Just as much under-appreciated is that although Windows Vista and Windows Server 2008 were marketed as very different, being for use as client and server respectively, their kernels are exactly one and the same. Also under-appreciated is that though Windows Server 2008 and Windows Server 2008 R2 sound alike, the kernel in the one is exactly that of Windows Vista (Service Pack 1) but the kernel in the other is exactly that of Windows 7, and thus are very, very different. On the assumption that similar unification of client and server editions is intended forever, I do not keep downloading releases of the server products just to check the correspondence with client products.
The version numbering gets indisputably quirky for Windows Vista, Windows 7, Windows 8 and Windows 8.1. These were each in their time promoted as a significant—even major—release, yet they all have the same major version number which anyway isn’t in any of the names. As if to acknowledge this as unsatisfactory, the major version number for Windows 10 leaps ahead to 10.
The NT Operating System Kernel (NTOSKRNL) is distributed with each Windows package in as many as four files:
The difference concerning Physical Address Extension (PAE) applies only to 32-bit (x86) builds. It is mostly a matter of specialising the memory manager to use 32-bit or 64-bit page table entries exclusively. In most versions, users can select the one or the other at boot time, through the /PAE and /NOPAE switches in BOOT.INI or the pae option in the Boot Configuration Data (BCD). Later versions also allow for selection of the PAE kernel to be forced by a /NOEXECUTE switch or nx option.
An installed system has either the single-processor kernels or the multi-processor kernels but not both. If the multi-processor kernels are installed, they are renamed to NTOSKRNL.EXE and NTKRNLPA.EXE as if for a single-processor system. Starting with version 6.2, an installed system has only the multi-processor PAE kernel but renamed to NTOSKRNL.EXE.
Put another way, the kernel’s standard name is NTOSKRNL.EXE, except that where the kernel may be installed both with and without support for PAE, the kernel has the two standard names NTOSKRNL.EXE and NTKRNLPA.EXE. In the versions that install both, the loader has the two standard names hard-coded. All versions can be directed to load an alternative as specified by a /KERNEL switch or kernel option.
The following 32-bit (x86) builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.
Special mention must be made of the very oldest builds. Even among the many discs I retain from MSDN subscriptions in the 1990s, what was then the new Windows that is entirely its own operating system rather than a large DOS program goes no further back than Windows NT 3.51 (almost as if Microsoft informally disowned the early builds). For decades I had little choice but to treat Windows NT 3.51 as the dawn of time for these notes. In 2017 someone pointed me to an online collection of earlier builds. The sample is inevitably incomplete. The provenance is unknown.
Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.
The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.
The kernel files for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE, NTKRNLPA.EXE, NTKRPAMP.EXE. Not all versions have all four. Versions before 5.0 have only NTOSKRNL.EXE and NTKRNLMP.EXE. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels in the same pattern as for earlier versions, but the installation image on the distribution media has only the multi-processor kernels, and these are already renamed to NTOSKRNL.EXE and NTKRNLPA.EXE. Version 6.2 and higher have only the multi-processor PAE kernel, already renamed to NTOSKRNL.EXE.
|File Version||File Header Date Stamp||File Size||Package|
|3.10.511.1||2C921D20 (11th September 1993)
|Windows NT 3.1 Workstation|
|3.10.5908.1||2C51C0E8 (24th July 1993)
|Windows NT 3.1 Advanced Server|
|3.50.807.1||2FE8B905 (21st June 1995)
|Windows NT 3.5 SP3|
|3.51.1025.1||2FC653BC (27th May 1995)
|Windows NT 3.51|
|3.51.1057.6||321A03D2 (21st August 1996)
|Windows NT 3.51 SP5|
|4.0.1381.1||3255A915 (5th October 1996)
|Windows NT 4.0|
|4.0.1381.4||337546BF (11th May 1997)
|Windows NT 4.0 SP3|
|4.0.1381.133||36224CDA (13th October 1998)
|Windows NT 4.0 SP4|
|4.0.1381.204||371CD681 (21st April 1999)
|Windows NT 4.0 SP5|
|4.0.1381.335||37E8005B (22nd September 1999)
|Windows NT 4.0 SP6|
|5.0.2195.1||384D9B17 (8th December 1999)
|5.0.2195.1620||39760637 (20th July 2000)
|Windows 2000 SP1|
|5.0.2195.5438||3D366B8B (18th July 2002)
|Windows 2000 SP3|
|5.0.2195.6717||3EE6C002 (11th June 2003)
|Windows 2000 SP4|
|5.1.2600.0||3B7DE38F (18th August 2001)
|5.1.2600.1106||3D6DE35C (29th August 2002)
|Windows XP SP1|
|5.1.2600.2180||41108004 (4th August 2004)
|Windows XP SP2|
|5.1.2600.5512||48025EAB (14th April 2008)
|Windows XP SP3|
|5.2.3790.0||3E800A79 (25th March 2003)
|Windows Server 2003|
|5.2.3790.1830||42435E33 (25th March 2005)
|Windows Server 2003 SP1|
|5.2.3790.3959||45D6A072 (17th February 2007)
|Windows Server 2003 SP2|
|6.0.6000.16386||4549AD6C (2nd November 2006)
|6.0.6001.18000||47918B0A (19th January 2008)
|Windows Vista SP1, Windows Server 2008|
|6.0.6002.18005||49E01996 (11th April 2009)
|Windows Vista SP2|
|6.1.7600.16385||4A5BBFFC (14th July 2009)
|6.1.7601.17514||4CE78A06 (20th November 2010)
|Windows 7 SP1|
|6.2.9200.16384||5010ADF0 (25th July 2012)||5,563,120||Windows 8|
|6.3.9600.16384||52157309 (21st August 2013)||5,757,792||Windows 8.1|
|6.3.9600.17031||53085A16 (22nd February 2014)||5,786,968||Windows 8.1 With Update|
|10.0.10240.16384||559F3E62 (9th July 2015)||6,263,648||Windows 10|
|10.0.10586.0||5632D21B (29th October 2015)||5,797,728||Windows 10 Version 1511|
|10.0.14393.0||57898E79 (15th July 2016)||6,015,328||Windows 10 Version 1607|
|10.0.15063.0||58CCB6F3 (18th March 2017)||5,862,296||Windows 10 Version 1703|
|10.0.16299.15||59CDA2AC (28th September 2017)||6,404,504||Windows 10 Version 1709|
|10.0.17134.1||5ACD8A1D (11th April 2018)||6,717,856||Windows 10 Version 1803|
A self-extracting executable for Windows 2000 SP2 has been inspected for these notes but no kernels were found.
Each kernel in Windows Server 2008 is the same as in Windows Vista SP1, byte for byte.
Microsoft’s distribution of 64-bit Windows on MSDN discs in the early years was even less reliable than was my renewal of subscriptions. I seem never to have received a 64-bit edition of Windows XP, which is therefore not included in this study. (I suspect anyway that it was a build of version 5.2, i.e., of Windows Server 2003, rebadged for better marketing.) Though correspondents tell me that 64-bit Windows Vista was readily available the moment that Windows Vista was released, my experience is instead that an MSDN subscription in 2007 produced no x64 build of the original Windows Vista. The copy inspected of that is from an OEM disc. Though all service-pack builds that have been inspected for this study have been available through MSDN subscriptions, some of the copies studied have instead been downloaded as self-extracting executables from Microsoft’s free websites since, for who knows what reason, it frequently happened that the MSDN site that I paid for was intolerably slow—not that my tolerance was high, especially while Microsoft was at the time not just leaving me to the tedium of burning disks and labelling them, but telling me that their purpose was to be environmentally friendly.
Some Microsoft documentation, e.g., of the KeAcquireSpinLockRaiseToDpc function in the Windows Driver Kit (WDK) version 7600.16385.0 for Windows 7, talks of “64-bit versions of Windows 2000” but I don’t believe the MSDN site has ever listed such things even as being available to download. These notes are anyway just for the amd64 processor architecture, also commonly referred to as x64. Though early versions of Windows were small enough for the distribution media to have binaries for multiple processors, I was never interested: I do still have them, but I have no intention of listing them.
The kernels for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE. Not all versions have both. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels, but the installation image on the distribution media has only a multi-processor kernel, which is already renamed to NTOSKRNL.EXE.
|File Version||File Header Date Stamp||File Size||Package|
|5.2.3790.1830||42436096 (25th March 2005)
|Windows Server 2003 SP1|
|5.2.3790.3959||45D69A26 (17th February 2007)
|Windows Server 2003 SP2|
|6.0.6000.16386||4549B6C6 (2nd November 2006)||4,420,712||Windows Vista|
|6.0.6001.18000||479192B7 (19th January 2008)||4,694,072||Windows Vista SP1, Windows Server 2008|
|6.0.6002.18005||49E0237F (11th April 2009)||4,699,608||Windows Vista SP2|
|6.1.7600.16385||4A5BC600 (14th July 2009)||5,511,248||Windows 7, Windows Server 2008 R2|
|6.1.7601.17514||4CE7951A (20th November 2010)||5,563,776||Windows 7 SP1, Windows Server 2008 R2 SP1|
|6.2.9200.16384||5010AC4B (25th July 2012)||6,969,584||Windows 8|
|6.3.9600.16384||5215D156 (22nd August 2013)||7,416,160||Windows 8.1|
|6.3.9600.17031||53085AF2 (22nd February 2014)||7,425,368||Windows 8.1 With Update|
|10.0.10240.16384||559F3C1A (9th July 2015)||8,020,832||Windows 10|
|10.0.10586.0||5632D2D1 (29th October 2015)||7,477,600||Windows 10 Version 1511|
|10.0.14393.0||578998F1 (15th July 2016)||7,814,496||Windows 10 Version 1607|
|10.0.15063.0||58CCBA4C (18th March 2017)||8,319,904||Windows 10 Version 1703|
|10.0.16299.15||59CDA780 (28th September 2017)||8,592,280||Windows 10 Version 1709|
|10.0.17134.1||5ACD8966 (11th April 2018)||9,159,072||Windows 10 Version 1803|
Where two packages are shown for the same build, the executables are identical. This identity is not just observed for Windows 7 SP1 and Windows Server 2008 R2 SP1 but formalised in the sense that Microsoft provides the one self-extracting executable for both product names.