ArialMicrosoft recently introduced version 4.0 of NT Workstation (NTW) and NT
Server (NTS), and claims that there are substantial technical differences
between the Workstation and Server products. Microsoft uses this claim to
justify an $800 price difference between NTW and NTS, as well as legal
{HYPERLINK
"ftp://ftp.ora.com/pub/examples/windows/win95.update/ntwk4.html"} limits on
web server usage in NTW, both of which have enormous impact on existing
NTW users. But what if the supposed technical differences at the heart of
NTW and NTS are mythical?
We have found that NTS and NTW have identical kernels; in fact, NT is a
single operating system with two modes. Only two registry settings are
needed to switch between these two modes in NT 4.0, and only one setting
in NT 3.51. This is extremely significant, and calls into question the related
legal limitations and costly upgrades that currently face NTW users.
0100,0100,0100Times New RomanMuch of the research discussed in this article was done by NT
Internals expert {HYPERLINK "http://www.ntinternals.com"}0000,0000,FF00Dr.
Mark Russinovich0100,0100,0100, a Consulting Associate for {HYPERLINK
"http://www.osr.com"}0000,0000,FF00Open System Resources0100,0100,0100, Inc. Russinovich is
coauthor of numerous NT systems utilities, such as the
{HYPERLINK
"ftp://ftp.ora.com/pub/examples/windows/win95.update/regist ry.html"
\l "ntregmon"}0000,0000,FF00NT registry monitor0100,0100,0100, the {HYPERLINK
"ftp://ftp.ora.com/pub/examples/windows/win95.update/ntfmo
n.html"}0000,0000,FF00NT file monitor0100,0100,0100, and the {HYPERLINK
"http://www.ntinternals.com/ntfsdos.htm"}0000,0000,FF00NTFS file system for DOS0100,0100,0100.
ARIAL..... (full article is quite long) ..
0100,0100,0100Times New RomanNT 4.0: ProductType and
SystemPrefix registry settings
Some Microsoft employees have privately admitted that the
differences between NTS and NTW 3.51 were minimal.
However, they have gone on to claim that now everything is
different in version 4.0. We've already established that in fact
NTS 4.0 and NTW 4.0 have exactly the same kernel, and in
fact exactly the same of everything but the costly extras bundled
in with NTS.
But what of the magical 3.51 "ProductType" registry setting? It's
still there, and it still plays the same role in 4.0 that it did in 3.51
in distinguishing between the Server and Workstation modes
(see {HYPERLINK \l "table"}0000,0000,FF00table0100,0100,0100 above). Microsoft has
merely added an additional registry setting, and made some
effort to prevent the user from changing these settings. The extra
setting is:
Times New RomanThe SystemPrefix value is a binary value which the kernel treats
as two DWORDs, of which the only important piece of
information seems to be the bit represented by the mask
0x04000000 in the high-order DWORD. If ProductType is
"ServerNT" or "LanmanNT", then this bit must be set. If
ProductType is "WinNT" then the bit must be off (any
inconsistency results in a blue-screen error at system boot).
The system spawns two worker threads that watch for, and
override, changes to the two registry keys. If an attempt is
made to change ProductType, the threads changes the settings
back (really! you can see this happen if you manually refresh in
REGEDT32) and pops up the following warning box:
Courier New"The system has detected tampering with your
registered product type.
This is a violation of your software license.
Tampering with product
type is not permitted."
Times New RomanHowever, if the worker threads are overriden,{HYPERLINK \l
"hook"}0000,0000,FF00*0100,0100,0100 then after making these changes and rebooting, a
formerly NTW 4.0 system functions as an NTS 4.0 system.
The NET ACCOUNTS command reports "Computer Role:
SERVER" and the taskbar start menu's bitmap changes from
"Windows NT Workstation" to "Windows NT Server".
Eamonn Sullivan of PC Week has confirmed that, when an
NTW machine is tweaked via the registry into an NTS machine,
web performance "tests on this "altered" Workstation were
identical (within the margin of error) to Server." (See
{HYPERLINK
"http://www.pcweek.com/news/0902/06ent.html"}0000,0000,FF00PC Week0100,0100,0100
article, "Simple way found to turn NT Workstation into
Server.")
If an attempt is made to install Microsoft's BackOffice suite on a
workstation-mode NT system, the BackOffice setup program will prevent
installation of the BackOffice programs and indicate that NT Server must
be installed first. If the system type is then changed to server in the registry
as described above and another attempt is made to install BackOffice, then
the installation of the suite programs is possible. Curiously, if you then
change the system back to NTW mode, BackOffice continues to run fine --
so it is only the setup/install program that cares.
---
To summarize, NTS is simply NTW plus some configuration changes, a set
of bundled programs (IIS, DNS, etc.), a license for more LAN users, and
apparently for more web users. NTS is a package deal: if you want to
publish to a reasonable number of web users (more than ten!), you must get
the more expensive NTS package, which also has things you may not need,
such as Microsoft's own web server. Having paid the higher price which
includes Microsoft's own web server, you're unlikely to consider purchasing
a third-party web server. Those third-party web servers, combined with the
lower price of NTW, would be a cheaper solution that Microsoft's NTS/IIS
bundle, but Microsoft's license agreement prevents you from opting for this
better solution. Microsoft is restricting how you can use its operating system
until you agree to buy its server products.
---
NOTE: *The purpose of this article is to point out the minimal differences between
NTS and NTW, and to get Microsoft to change its licensing and/or marketing of NT.
The purpose is not to have individual users change the registry and therefore bypass
their Microsoft license agreement. We want Microsoft, not you, to make this change.
At the same time, we've received requests for further information on making this
change in NT 4.0 (it is, as shown earlier, trivial in {HYPERLINK \l "nt351"}0000,0000,FF003.510100,0100,0100). Mark Russinovich has written a
utility, NTTune, which can make the workstation-to-server registry change in 4.0. We
are quite deliberately not making this available, however. We used NTTune to verify
our tests, and made NTTune available to some members of the press so they could
independently test our claims. That's it.
NTTune uses a technique developed by Mark Russinovich and Bryce Cogswell called
"system call hooking." This technique is also used in their NT registry monitor,
{HYPERLINK "ftp://ftp.ora.com/pub/examples/windows/win95.update/registry.html" \l "ntregmon"}0000,0000,FF00NTRegMon0100,0100,0100. Russinovich and Cogswell will be describing System Call Hooking in a
forthcoming article in Dr. Dobb's Journal. ({HYPERLINK \l "override"}0000,0000,FF00Back to text0100,0100,0100)
---
* Origin: [adminz] tech, security, support (192.168.0.2)
generated by msg2page 0.06 on Jul 21, 2006 at 19:04:56
cool tools