NTDLL Versions

As the kernel’s footprint in user mode, NTDLL.DLL is essential to the Windows NT architecture from the start. Major version 4, however, is shared with the 32-bit Windows that runs on DOS. Only in the NT versions of Windows is NTDLL.DLL a substantial executable.

File Version Distribution
Windows NT
3.10   Windows NT 3.10
3.50   Windows NT 3.50
3.51   Windows NT 3.51
4.0 Windows 95 Windows NT 4.0
4.10 Windows 98  
4.90 Windows Me  
5.0   Windows 2000
5.1   Windows XP
5.2   Windows Server 2003
6.0   Windows Vista
Windows Server 2008
6.1   Windows 7
Windows Server 2008 R2
6.2   Windows 8
6.3   Windows 8.1
10.0   Windows 10

Until version 6.0 reunified client and server editions under different product names, each new name for a Windows package brought at least a change of the minor version number. (Yes, that should be unremarkable, but compare with DLLs from the Windows Shell, some of which kept to one version number for all of Windows XP, Windows Server 2003, Windows Vista and Windows Server 2008.)

The version numbering gets indisputably quirky for Windows Vista, Windows 7, Windows 8 and Windows 8.1. These were each in their time promoted as a significant—even major—release, yet they all have the same major version number which anyway isn’t in any of the names. As if to acknowledge this as unsatisfactory, the major version number for Windows 10 leaps ahead to 10.


The following builds have been inspected for these notes. Most are from MSDN discs. Some, especially since Microsoft greatly reduced its shipment of operating systems on MSDN discs, are from service packs downloaded (typically as self-extracting executables) from a Microsoft website.

Special mention must be made of the very oldest builds. Even among the many discs that I retain from MSDN subscriptions in the mid-1990s, what was then the new Windows that is entirely its own operating system rather than a large DOS program goes no further back than Windows NT 3.51. For all practical effect, Microsoft informally disowned the early versions, even for its so-called Archive editions. For decades I had little choice but to treat Windows NT 3.51 as the dawn of time for these notes. In 2017 someone pointed me to an online collection of earlier builds. The sample is inevitably incomplete. The provenance is unknown. I have since sought more: the WinWorld online museum is notable.

Builds are arranged in increasing order of the file version as recorded in the executable’s resources. This version number is readily visible using Windows Explorer either in a so-called infotip for the file or by accessing the Version tab in the Properties dialog for the file. Programmers know this version number as coming from the so-called root block of the version-information resource, specifically from the dwFileVersionMS and dwFileVersionLS members of a VS_FIXEDFILEINFO structure.

The date stamp shown for each version is more obscure. File dates are easily modified after the executable is built and are anyway liable to be shown differently when read from different time zones. However, there is in each executable’s header a date stamp which is set when the executable is built and which is not commonly changed afterwards. It is readily accessible to anyone with programming knowledge and appropriate tools, e.g., Microsoft’s own DUMPBIN utility.

Any study worth making of Windows—and please remember that the list below exists only as a catalogue of which builds I have obtained for study—is much too intensive to cover pre-release builds, hot fixes and other updates. Access to pre-release builds anyway tends to come with constraints and compromise that other researchers may tolerate (and even be happy with) but which I do not. None of this work is done with any sort of assistance from Microsoft beyond the binaries, as published by the tens and even hundreds of millions, and the same documentation that’s available to all Windows programmers.

32-Bit Windows (x86)

For the versions of Windows that runs on MS-DOS, NTDLL exists only as a small collection of stub functions, and might more usefully be considered a different executable.

File Version File Header Date Stamp File Size Package
3.10.497.1 2C4F15D7 (22nd July 1993) 264,676 Windows NT 3.10 Advanced Server
Windows NT 3.10 Workstation
3.10.511.1 2DA1DF9B (5th April 1994) 264,660 Windows NT 3.10 SP3
3.50.800.1 2E67E68D (2nd September 1994) 269,120 Windows NT 3.50
3.50.807.1 2FCE52C7 (1st June 1995) 267,072 Windows NT 3.50 SP3
3.51.1025.1 2FC3AE99 (25th May 1995) 307,088 Windows NT 3.51
3.51.1057.3 3061C531 (21st September 1995) 307,088 Windows NT 3.51 SP2
Windows NT 3.51 SP3
3.51.1057.4 30D0DB93 (14th December 1995) 307,088 Windows NT 3.51 SP4
3.51.1057.6 3214F49D (17th August 1996) 307,088 Windows NT 3.51 SP5 2FF36CC2 (30th June 1995) 5,632 Windows 95
Windows 95 OSR2
4.0.1376.1 31F3C73E (23rd July 1996) 353,552 Windows NT 4.0
4.0.1381.3 329F4942 (29th November 1996) 355,088 Windows NT 4.0 SP2
4.0.1381.4 334EA15A (12th April 1997) 355,088 Windows NT 4.0 SP3
4.0.1381.130 361D3EA2 (9th October 1998) 355,600 Windows NT 4.0 SP4
4.0.1381.174 36D5E9A4 (26th February 1999) 363,792 Windows NT 4.0 SP5
4.0.1381.298 3786600B (10th July 1999) 366,864 Windows NT 4.0 SP6 3546AB93 (29th April 1998) 20,480 Windows 98
Windows 98 SE 39403BE1 (9th June 2000) 20,480 Windows Me
5.0.2163.1 38175B30 (28th October 1999) 481,040 Windows 2000
5.0.2195.1600 394193D2 (10th June 2000) 486,672 Windows 2000 SP1
5.0.2195.5400 3D3D0209 (23rd July 2002) 490,768 Windows 2000 SP3
5.0.2195.6685 3EF274DC (20th June 2003) 491,792 Windows 2000 SP4
5.1.2600.0 3B7DE01E (18th August 2001) 674,304 Windows XP
5.1.2600.1106 3D6DFA28 (29th August 2002) 668,672 Windows XP SP1
5.1.2600.2180 411096B4 (4th August 2004) 708,096 Windows XP SP2
5.1.2600.5512 4802A12C (14th April 2008) 706,048 Windows XP SP3
5.2.3790.0 3E802494 (25th March 2003) 739,840 Windows Server 2003
5.2.3790.1830 424377D2 (25th March 2005) 766,464 Windows Server 2003 SP1
5.2.3790.3959 45D70AD8 (18th February 2007) 765,440 Windows Server 2003 SP2
6.0.6000.16386 4549BDC9 (2nd November 2006) 1,162,656 Windows Vista
6.0.6001.18000 4791A7A6 (19th January 2008) 1,203,792 Windows Vista SP1
Windows Server 2008
6.0.6002.18005 49E03821 (11th April 2009) 1,202,168 Windows Vista SP2
6.1.7600.16385 4A5BDADB (14th July 2009) 1,286,144 Windows 7
6.1.7601.17514 4CE7B96E (20th November 2010) 1,288,488 Windows 7 SP1
6.2.9200.16384 5010AEB6 (25th July 2012) 1,472,896 Windows 8
6.3.9600.16384 52159006 (22nd August 2013) 1,445,728 Windows 8.1
6.3.9600.17031 53088928 (22nd February 2014) 1,451,392 Windows 8.1 With Update
10.0.10240.16384 559F3AAC (9th July 2015) 1,535,576 Windows 10

Where packages are listed on the same row, the binaries are exactly identical, except as noted in the next two paragraphs which anyway apply only to the Windows that runs on DOS.

For the two Windows 95 versions (original and OSR2) and the two Windows 98 versions (original and SE), the only difference between the binaries in each pair is that the later is built with newer import libraries for some DLLs, so that each executable has a slightly different Import Address Table and a different checksum in the executable’s header.

The build for Windows Me differs from the two for Windows 98 only by a change of version number and by rebasing, both for the executable itself and for imported addresses, with a corresponding change in the file header’s date stamp and checksum.

Among the gaps in service packs for early versions, note for definiteness that a Windows NT 4.0 SP1 and a Windows 2000 SP2 have been obtained for inspection but do not contain an NTDLL.DLL.

64-Bit Windows (amd64)

Microsoft’s distribution of 64-bit Windows on MSDN discs in the early years was even less reliable than was my renewal of subscriptions. I seem never to have received a 64-bit edition of Windows XP, which is therefore not included in this study. (I suspect anyway that it was a build of version 5.2, i.e., of Windows Server 2003, rebadged for better marketing.) Though correspondents tell me that 64-bit Windows Vista was readily available the moment that Windows Vista was released, my experience is instead that a year-long MSDN subscription in 2007 produced no x64 build of the original Windows Vista. The copy inspected of that is instead from an OEM disc.

Though all service-pack builds that have been inspected for this study have been available through MSDN subscriptions, some of the copies studied have instead been downloaded as self-extracting executables from Microsoft’s free websites since, for who knows what reason, it frequently happened that the MSDN site that I paid to access was intolerably slow—not that my tolerance was high, especially while Microsoft was at the time not just leaving me to the tedium of burning disks and labelling them, but telling me that their purpose was to be environmentally friendly.

File Version File Header Date Stamp File Size Package
5.2.3790.1830 42438B79 (25th March 2005) 1,257,472 Windows Server 2003 SP1
5.2.3790.3959 45D6CC72 (17th February 2007) 1,254,400 Windows Server 2003 SP2
6.0.6000.16386 4549D372 (2nd November 2006) 1,533,992 Windows Vista
6.0.6001.18000 4791ADEC (19th January 2008) 1,559,696 Windows Vista SP1
Windows Server 2008
6.0.6002.18005 49E0421D (11th April 2009) 1,582,792 Windows Vista SP2
6.1.7600.16385 4A5BE02B (14th July 2009) 1,736,792 Windows 7
Windows Server 2008 R2
6.1.7601.17514 4CE7C8F9 (20th November 2010) 1,731,936 Windows 7 SP1
Windows Server 2008 R2 SP1
6.2.9200.16384 5010ACD2 (25th July 2012) 1,825,216 Windows 8
6.3.9600.16384 5215F938 (22nd August 2013) 1,722,608 Windows 8.1
6.3.9600.17031 530895AF (22nd February 2014) 1,727,760 Windows 8.1 With Update
10.0.10240.16384 559F384F (9th July 2015) 1,822,832 Windows 10

Where two packages are shown for the same build, the executables are identical. This identity is formalised for Windows 7 SP1 and Windows Server 2008 R2 SP1 since Microsoft provides the one self-extracting executable for both product names.

32-Bit Windows on 64-Bit Windows (wow64)

NTDLL is sufficiently low-level that its 32-bit executables for 64-bit Windows differ from those of the corresponding 32-bit Windows versions.

File Version File Header Date Stamp File Size Package
5.2.3790.1830 42437794 (25th March 2005) 762,880 Windows Server 2003 SP1
5.2.3790.3959 45D709FF (17th February 2007) 766,464 Windows Server 2003 SP2
6.0.6000.16386 4549BDF8 (2nd November 2006) 1,145,664 Windows Vista
6.0.6001.18000 4791A783 (19th January 2008) 1,165,688 Windows Vista SP1
Windows Server 2008
6.0.6002.18005 49E03824 (11th April 2009) 1,165,088 Windows Vista SP2
6.1.7600.16385 4A5BDB3B (14th July 2009) 1,289,712 Windows 7
Windows Server 2008 R2
6.1.7601.17514 4CE7BA58 (20th November 2010) 1,292,096 Windows 7
Windows Server 2008 R2 SP1
6.2.9200.16384 5010AE7A (25th July 2012) 1,409,384 Windows 8
6.3.9600.16384 52159015 (22nd August 2013) 1,471,544 Windows 8.1
6.3.9600.17031 5308893D (22nd February 2014) 1,474,104 Windows 8.1 With Update
10.0.10240.16384 559F3AAB (9th July 2015) 1,533,496 Windows 10

Where two packages are shown for the same build, the executables are identical.