Kernel Versions

Each new name for a Windows package brings at least a change of the minor version number until contemporaneous client and server editions are reunited for version 6.0:

File Version Distribution
3.51 Windows NT 3.51
4.0 Windows NT 4.0
5.0 Windows 2000
5.1 Windows XP
5.2 Windows Server 2003
6.0 Windows Vista
Windows Server 2008
6.1 Windows 7
Windows Server 2008 R2

After version 6.0, the next change in the minor version number is a change of name in client ediitions but is just an epithet for the contemporaneous server edition.

Files

The NT kernel is distributed with each Windows package in as many as four files:

An installed system has either the single-processor kernels or the multi-processor kernels but not both. If the multi-processor kernels are installed, they are renamed as if for a single-processor system. Put another way, the single-processor kernels have the standard names.

The difference concerning Physical Address Extension (PAE) is mostly a matter of specialising the memory manager to use 32-bit or 64-bit page table entries exclusively. Users can select the one or the other at boot time, through the /PAE and /NOPAE switches in BOOT.INI or the pae option in the Boot Configuration Data (BCD). Later versions also allow for selection of the PAE kernel to be forced by a /NOEXECUTE switch or nx option.

The loader has the standard names hard-coded. Unless an alternative is specified by a /KERNEL switch or kernel option, the kernel that is loaded is whatever file is named NTOSKRNL.EXE ordinarily or NTKRNLPA.EXE if PAE is wanted.

Builds

The following builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.

Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.

The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.

File Version File Header Date Stamp File Size Package
3.51.1025.1 2FC653BC (27th May 1995)
2FC653E6
804,864
816,592
Windows NT 3.51
3.51.1057.6 321A03D2 (21st August 1996)
321A03F0
809,488
821,296
Windows NT 3.51 SP5
4.0.1381.1 3255A915 (5th October 1996)
3255A937
868,288
884,928
Windows NT 4.0
4.0.1381.4 337546BF (11th May 1997)
337546EF
914,688
934,016
Windows NT 4.0 SP3
4.0.1381.133 36224CDA (13th October 1998)
36224D24
927,552
947,584
Windows NT 4.0 SP4
4.0.1381.204 371CD681 (21st April 1999)
371CD6A1
928,576
948,544
Windows NT 4.0 SP5
4.0.1381.335 37E8005B (22nd September 1999)
37E80077
931,584
951,808
Windows NT 4.0 SP6
5.0.2195.1 384D9B17 (8th December 1999)
384D5A76
384D5A86
384D5A97
1,640,976
1,611,712
1,611,840
1,632,000
Windows 2000
5.0.2195.1620 39760637 (20th July 2000)
3975DFDF
3975DFFA
3975DFFA
1,702,800
1,677,696
1,677,760
1,698,304
Windows 2000 SP1
5.0.2195.5438 3D366B8B (18th July 2002)
3D362A77
3D362A90
3D362A99
1,712,720
1,687,552
1,687,360
1,707,904
Windows 2000 SP3
5.0.2195.6717 3EE6C002 (11th June 2003)
3EE650B3
3EE650C9
3EE650CD
1,719,056
1,694,976
1,694,080
1,715,008
Windows 2000 SP4
5.1.2600.0 3B7DE38F (18th August 2001)
3B7DC674
3B7D82F5
3B7D82F9
1,982,208
1,897,984
1,896,704
1,869,824
Windows XP
5.1.2600.1106 3D6DE35C (29th August 2002)
3D6DD59C
3D6DD59C
3D6DD59C
2,042,240
1,891,840
1,947,904
1,920,512
Windows XP SP1
5.1.2600.2180 41108004 (4th August 2004)
41107FAA
41107B0C
41107B0D
2,180,992
2,148,352
2,056,832
2,015,232
Windows XP SP2
5.1.2600.5512 48025EAB (14th April 2008)
48025DE7
4802516A
4802516A
2,188,928
2,145,280
2,065,792
2,023,936
Windows XP SP3
5.2.3790.0 3E800A79 (25th March 2003)
3E8015C6
3E800012
3E800013
2,201,600
2,401,792
2,062,848
2,105,344
Windows Server 2003
5.2.3790.1830 42435E33 (25th March 2005)
42435E60
42435B14
42435B14
2,414,592
2,452,480
2,266,624
2,306,560
Windows Server 2003 SP1
5.2.3790.3959 45D6A072 (17th February 2007)
45D6A0AF
45D69710
45D69710
2,430,464
2,469,888
2,280,960
2,321,408
Windows Server 2003 SP2
6.0.6000.16386 4549AD6C (2nd November 2006)
4549AE00
3,467,880
3,502,184
Windows Vista
6.0.6001.18000 47918B0A (19th January 2008)
47918B12
3,548,728
3,600,440
Windows Vista SP1, Windows Server 2008
6.0.6002.18005 49E01996 (11th April 2009)
49E0199E
3,549,672
3,601,896
Windows Vista SP2
6.1.7600.16385 4A5BBFFC (14th July 2009)
4A5BC007
3,899,472
3,954,768
Windows 7
6.1.7601.17514 4CE78A06 (20th November 2010)
4CE78A09
3,911,040
3,966,848
Windows 7 SP1

The kernel files for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE, NTKRNLPA.EXE, NTKRPAMP.EXE. Versions before 5.0 have only NTOSKRNL.EXE and NTKRNLMP.EXE. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels in the same pattern as for earlier versions, but the installation image on the distribution media has only the multi-processor kernels, and these are already renamed to NTOSKRNL.EXE and NTKRNLPA.EXE.

A self-extracting executable for Windows 2000 SP2 has been inspected for these notes but no kernels were found.

Each kernel in Windows Server 2008 is the same as in Windows Vista SP1, byte for byte.

64-Bit Windows

Microsoft’s distribution of 64-bit Windows on MSDN discs is even less reliable than is my renewal of subscriptions. I seem never to have received a 64-bit edition of Windows XP, which is therefore not included in this study. Though correspondents tell me that 64-bit Windows Vista was readily available the moment that Windows Vista was released, my experience is instead that an MSDN subscription in 2007 produced no x64 build of the original Windows Vista. The copy inspected of that is from an OEM disc. Though all service-pack builds that have been inspected for this study are available through an MSDN subscription, the copies studied have instead been downloaded as self-extracting executables from Microsoft’s free websites since, for who knows what reason, the MSDN site that I pay for is intolerably slow—not that my tolerance is high, given that Microsoft leaves me to the tedium of burning disks and labelling them and has the nerve to tell me that doing so is environmentally friendly.

File Version File Header Date Stamp File Size Package
5.2.3790.1830 42436096 (25th March 2005)
42436123
4,443,648
4,416,000
Windows Server 2003 SP1
5.2.3790.3959 45D69A26 (17th February 2007)
45D69AB4
4,496,896
4,566,528
Windows Server 2003 SP2
6.0.6000.16386 4549B6C6 (2nd November 2006) 4,420,712 Windows Vista
6.0.6001.18000 479192B7 (19th January 2008) 4,694,072 Windows Vista SP1, Windows Server 2008
6.0.6002.18005 49E0237F (11th April 2009) 4,699,608 Windows Vista SP2
6.1.7600.16385 4A5BC600 (14th July 2009) 5,511,248 Windows 7, Windows Server 2008 R2
6.1.7601.17514 4CE7951A (20th November 2010) 5,563,776 Windows 7 SP1, Windows Server 2008 R2 SP1

The kernels for each build are listed in the order: NTOSKRNL.EXE, NTKRNLMP.EXE. Versions from 6.0 onwards are built with both single-processor and multi-processor kernels, but the installation image on the distribution media has only a multi-processor kernel, which is already renamed to NTOSKRNL.EXE.

Where two packages are shown for the same build, the executables are identical. This identity is formalised for Windows 7 SP1 and Windows Server 2008 R2 SP1 since Microsoft provides the one self-extracting executable for both product names.

Some Microsoft documentation, e.g., of the KeAcquireSpinLockRaiseToDpc function in the Windows Driver Kit (WDK) version 7600.16385.0 for Windows 7, talks of “64-bit versions of Windows 2000” but I don’t believe the MSDN site has ever listed such things even as being available to download.