Service Packs and Hotfixes

Q. What service packs and fixes are available?

A. See table below. All directories are off of ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40. Just click on the file name for a direct FTP link For people in Europe ftp.sunet.se/pub3/vendor/microsoft/bussys/winnt/winnt-public/fixes may provide faster access.

There are also Microsoft BBS numbers where Service Packs can be downloaded from, e.g. for the UK it is 44 1734 270065, however the fixes tend to be a few days later than on the FTP site.

Service Pack 1 Hotfixes /hotfixes-postsp1/

Service Pack 2 Hotfixes /hotfixes-postsp2/

Service Pack 3 Hotfixes /hotfixes-postsp3/

A number of post Service Pack 3 hotfixes have been replaced by newer fixes and are not listed above, they can be found at ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/archive . These include

• dbclclick-fix
• icmp-fix
• java-fix
• land-fix
• lsa-fix
• mdl-fix
• oob-fix
• pptp-fix

The file names above are for the Intel platform (hence the ending I), but they may also be available for Alpha and PPC, just substitute the I for a A(Alpha) or P(PPC).

I should note a health warning, "If it ain't broke, don't fix it" and I would tend to agree with this, so unless you have a problem, or require a new feature of a Service Pack think if you really want it. Also if you are going to apply it to a live system, try and test it first, as sometimes a Service Pack will introduce new problems.

Q. What are the Q numbers and how do I look them up?

A. The Q numbers relate to Microsoft Knowledge Base articles and can be viewed at http://support.microsoft.com/support/

Q. How do I install the Service Packs?

A. If you receive the Service Pack by downloading from a Microsoft FTP site, then copy the file to a temporary directory and then just enter the file name (e.g. Sp2_400i.exe). The file will be expanded and among the files created a file called UPDATE.EXE will be created. Just run this file. If there is no UPDATE.EXE, just .sym files you have downloaded the symbols version which is used for debugging NT, download the normal version (see above).

If you receive Service Packs via CD, if you just insert the CD (for SP2 and later) and an Internet Explorer page will be shown and you can just click on install for the Service Pack.

Q. How do I install the Hot fix?

A. Again copy the file to a temporary directory and run the file name. A few files will be created, one called HOTFIX.EXE. Run "HOTFIX /install" which will install the Hot Fix.

The newer Hot fixes (Java fix for Service Pack 3 onwards) you just double click on the downloaded file.

Q. How do I remove a Hot fix?

A. Use the command Hotfix /remove. To force the remove using the registry editor (regedt32) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\HOTFIX and delete the entry for the HOTFIX. Then use explorer to goto %SystemRoot%\HOTFIX\HF00?? and copy the backed up files back to their original location.

Q. How do I install Service Pack 3?

A. Before you install Service Pack 3 you must remove Internet Explorer 4.0 preview if installed:

1. From Control Panel (Start - Settings - Control Panel) double click Add/Remove Programs
2. Select "Microsoft Internet Explorer 4.0" and click Add/Remove
3. Select Remove All
4. You will have to reboot

Also before installing SP3 make sure you have an up to date Repair Disk (RDISK /S). To install Service Pack 3 download Nt4sp3_i.exe and follow the instructions below

1. Double click nt4sp3_i.exe
2. It will verify the file and then uncompress to a temporary area (you can make it uncompress without installing by typing nt4sp3_i /x)
3. Click Next to install and click Yes to accept the license agreement
4. Click Next and then select "Yes create uninstall"
5. Click Next then Finish
6. You will then have to reboot

Q. Emergency Repair Disk issues after installation of Service Pack 3.

A. Due to changes in Service Pack 3 the Emergency Repair Disk process has changed. The file setupdd.sys that is on the 2nd NT installation disk has been superseded by the one supplied with service pack 3. To extract the file from the Service Pack 3 executable, follow the instructions below:

1. Copy nt4sp3_i.exe to a temporary area
2. Uncompress the service pack
   nt4sp3_i /x
3. Insert the second NT installation disk (do not use the originals, create a new set using winnt32 /ox)
4. Set the file setupdd.sys to write enabled
   attrib -r a:\setupdd.sys
5. Copy the new setupdd.sys to the 2nd installation disk
   copy setupdd.sys a:

This is discussed in the Service Pack 3 readme file, and also in knowledge base article Q146887.

Q. How do I remove the Java Hotfix for Service Pack 3?

A. Manually unpack the hotfix
javafixi /x
Then type
hotfix -y
And it will remove the hotfix.

This method may become the new standard for hot fixes.

Q. How do I install multiple Hotfixes at the same time?

A. When you extract the files in a hotfix, generally the following will be extracted

• hotfix.exe
• hotfix.inf
• a number of executables/drivers/sys files etc (usually one file)

The hotfix.exe is the same executable for all the hotfixes, and the hotfix.inf is basically the same, the only difference is the files that are to be copied, e.g. tcpip.sys, and a description of the hotfix. To install multiple hotfixes at the same time all that is needed is to decompress the hotfix files and update the hotfix.inf with the information on which files to copy.

1. Create a directory on a disk called hotfix
   md hotfix
2. From the command line decompress the hotfixes you wish to install, note each time you decompress a hotfix a new hotfix.inf will overwrite the existing one so you may wish to backup the .inf files
   - <hotfix name> /x, e.g. javafixi /x
   - you will be asked where to extract the hot fix files to, enter the hotfix directory and click OK, e.g. d:\hotfix
   - copy the hotfix.inf file to the name of the hotfix, e.g.
   copy hotfix.inf javafix.inf
3. You will now have a number of files in the hotfix directory, with hotfix.exe, hotfix.inf and all the versions of the .inf files you copied. You now need to merge the contents of the .inf files into one main hotfix.inf file.
   If the hotfix you extracted had file tcpip.sys (ignore the .dbg files) you need to update the hotfix.inf file to include the copying of this file. Since TCPIP.SYS lives in the system32/drivers directory, you would add the line TCPIP.SYS to the [Drivers.files] section of the hotfix.inf file, e.g.
   [Drivers.files]
   TCPIP.SYS
   You also need to add TCPIP.SYS to the [SourceDisksFiles] section, e.g.
   [SourceDisksFiles]
   TCPIP.SYS = 1
4. Finally you need to add a comment at the end of the hotfix.inf file with a description of the hotfix in the [strings] section with the Q number and a comment, e.g.
   [Strings]
   ..
   HOTFIX_NUMBER="Q143478"
   COMMENT="This fix corrects the port 139 OOB attack"

The reason we copied the .inf files is that you can just cut and paste the hotfix specific information to the common hotfix.inf. When you decompressed a hotfix you will see which files were created, you could then search the .inf file for the file name and it would be in two places, the directory it belongs in and the [SourceDisksFiles] section. You could then go to the bottom of the file and cut and paste the HOTFIX_NUMBER and COMMENT and add to the end of HOTFIX.INF.

This is very hard to explain and an example is probably the best way to demonstrate this. Suppose you want to install

• The java hotfix - javafixi.exe
• The OOB data hotfix - oobfix_i.exe
• The GetAdmin hotfix - admnfixi.exe

The procedure would be as follows

1. Decompress the hotfixes to the hotfix directory and after each extraction backup the hotfix.inf file in the order admnfixi.exe - javafixi.exe - oobfix_i.exe
2. Admnfixi.exe consists of ntkrnlmp.exe and ntoskrnl.exe, search admnfixi.inf (the copy we made) for the files and they appear as follows
   [Uniprocessor.Kernel.files]
   NTOSKRNL.EXE
   
   [Multiprocessor.Kernel.files]
   NTOSKRNL.EXE, NTKRNLMP.EXE
   
   [SourceDisksFiles]
   NTKRNLMP.EXE = 1
   NTOSKRNL.EXE = 1
   
   [Strings]
   HOTFIX_NUMBER="Q146965"
   COMMENT="This fix corrects GETADMIN problem"
3. javafixi.exe consists of win32k.sys so search javafixi.inf for win32k.sys
   [MustReplace.System32.files]
   WIN32K.SYS
   
   [SourceDisksFiles]
   WIN32K.SYS = 1
   
   [Strings]
   HOTFIX_NUMBER="Q123456"
   COMMENT="This fix corrects the problem with True Color adapter cards and Java"
4. The current version of hotfix.inf already contains the information for the oobfix as it was the last installed, so the information for the above 2 must be added resulting in the changes being
   
   [MustReplace.System32.files]
   WIN32K.SYS
   
   [Drivers.files]
   TCPIP.SYS
   
   [Uniprocessor.Kernel.files]
   NTOSKRNL.EXE
   
   [Multiprocessor.Kernel.files]
   NTOSKRNL.EXE, NTKRNLMP.EXE
   
   [SourceDisksFiles]
   NTKRNLMP.EXE = 1
   NTOSKRNL.EXE = 1
   TCPIP.SYS = 1
   WIN32K.SYS = 1
   
   [Strings]
   HOTFIX_NUMBER="Q143478"
   COMMENT="This fix corrects the port 139 OOB attack"
   HOTFIX_NUMBER="Q146965"
   COMMENT="This fix corrects GETADMIN problem"
   HOTFIX_NUMBER="Q123456"
   COMMENT="This fix corrects the problem with True Color adapter cards and Java"

To install just type

hotfix

from the directory created (i.e. hotfix), you will see a dialog copying the files (the ones you have specified in the hotfix.inf file :-) ), and the system will reboot. To see what hotfixes are installed:

1. Start the Registry Editor (Regedit.exe)
2. Look at the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix values

Q. How do I install Hotfixes the same time as I install Service Pack 3 onwards?

A. Update.exe that ships with Service Pack 3 checks for the existance of a hotfix subdirectory, and if in that directory the files hotfix.exe and hotfix.inf are present you are asked when running update.exe if you also want to install the hotfixes.

1. Create a direrectory to hold the extracted Service Pack
   md servpack
2. Extract the Service Pack
   nt4sp3_i /x
   You will be asked for a directory, enter the created directory, e.g. e:\servpack and click OK
3. Create a hotfix subdirectory
   md hotfix
4. Extract the hotfixes to this directory using the instructions in the previous FAQ
5. Run UPDATE.EXE in the servpack directory and click Yes when asked to install Hotfixes

Q. I have installed Service Pack 3, now I cannot run Java programs.

A. Download the updated Java Virtual Machine from Microsoft at http://www.microsoft.com/java/download/dl_vmsp2.htm . Download build 1518 which works with IE3.01, IE 3.02 and IE 4.0 platform preview 1, do NOT install on IE 4.0 PP2 or the release version.

There is also a hotfix for Service Pack 3 available from Microsoft ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/java-fix/JAVAFIXI.EXE

Q. I have installed Service Pack 3, however the Policy Editor has not been updated.

A. This is caused by a mistake in the Service Pack 3 update.inf file. The entry for poledit.exe (the executable for the policy editor) is specified in the [MustReplace.system32.files] section whereas the file should actually be in the [SystemRoot.files].

To install the new Policy Editor perform the following

1. Expand the service pack
   nt4sp3_i /x
2. You will be asked for a directory, enter a path and click OK. A message "Extraction complete" will be displayed when completed
3. Move to the directory the service pack was extracted to and copy the file poledit.exe to the %systemroot% directory
   copy poledit.exe %systemroot%

Alternatively you can update the update.inf fiile and move the location of poledit.exe from [MustReplace.system32.files] to [SystemRoot.files].

Q. How can I tell if I have the 128 bit version of Service Pack 3 installed?

A. The easiest way to tell this is to examine the secure channel dynamic link library (SCHANNEL.DLL):

1. Start Explorer (Win + E or Start - Programs - Explorer)
2. Move to %systemRoot%/system32 (where %systemRoot is the windows NT directory, e.g. d:\winnt)
3. Right click on Schannel.dll and select properties
4. Click the Version tab. The description will be one of the following:
   PCT / SSL Security Provider (U.S. and Canada for the 128 bit version.) if you have the 128 bit version
   or
   PCT / SSL Security Provider (Export Version) if you have the non-128 bit version
5. Click OK when finished
6. Close Explorer

Q. How do I install a service pack during a unattended installation?

A. There are various options, however all of them require for the service pack to be extracted to a directory, using

NT4SP3_I /x

and you then enter the directory where you want to extract to.

You could extract to a directory under the $OEM$ installation directory which would then be copied locally during the installation and you could add the line

".\UPDATE.EXE -U -Z"

to CMDLINES.TXT. This will increase the time of the text portion of the installation as the contents have to be copied over the network.

An alternate method is to install from a network drive, this requires a bit more work:

1. Create a directory on a network server and copy the extracted service pack to this directory. Setup a share on this directory called SP
2. Create a batch file in the $OEM$ share of the installation area called SERVPACK.CMD with the following:
   net use z:\\<server>\SP /persistent:no /user:<domain name> \guest < password.txt
   z:\update.exe -u -z
3. You need to create the password.txt file that contains the guest account password (usually blank) therefore perform the following:
   - type copy con password.txt
   - press ENTER once
   - press CTRL+Z to save the file
   If the password is not blank enter the password then press ENTER
4. Copy the password.txt file to the $OEM$ directory
5. Edit CMDLINES.TXT and add ".\SERVPACK.CMD" to the end

Q. What order should I apply the Hot fixes?

A. The Service Pack 3 hotfixes are, for the most part, cumulative. This means that the latest binary also includes fixes previously made to the same binary.

For example, the 01/09/98 version of Tcpip.sys (teardrop2-fix) also includes previous fixes to Tcpip.sys (such as land-fix, icmp-fix, and oob-fix).

When you apply multiple fixes, please install them in the following order to ensure a newer fix is not replaced by an older one.

• oob-fix
• asp-fix
• java-fix
• dns-fix
• iis-fix
• lsa-fix
• dblclick-fix
• icmp-fix
• zip-fix
• roll-up (or roll-up/cluster)
• mdl-fix
• getadmin-fix
• roll-up/cluster
• winsupd-fix
• ndis-fix
• scsi-fix
• 2gcrash
• simptcp-fix
• ide-fix
• wan-fix
• land-fix
• pent-fix (x86 only)
• joystick-fix (x86 only)
• SAG-fix
• iis4-fix
• pptp-fix
• teardrop2-fix
• tapi21-fix
• pcm-fix
• srv-fix
• y2k-fix
• euro-fix
• atapi-fix
• netbt-fix
• prnt-fix
• sfm-fix
• pptp2-fix
• rras20-fix
• lsa2-fix
• ssl-fix
• priv-fix
• pptp3-fix
• rras30-fix

For the Microsoft version of the list please see ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/hotfixes-postSP3/postsp3.txt

Q. I get an error message when I try to re-apply a hotfix after installing a service pack?

A. If when you try and reinstall a hotfix (after re-applying a service pack etc.) you get the error

Hotfix: The fix is already installed.
Hotfix: Internal consistency error: Invalid Tree pointer = <garbage characters displayed>.

you need to remove the hotfix before trying to reinstall.

To remove a hotfix you would usually use hotfix /r or hotfix -y (depending on the version, to check how use /? on the hotfix for the syntax) however there are situations where it will refuse to remove the hotfix:

Hotfix: Fix <name of hotfix> was not removed.

All the hotfix actually does when you install one is to check a registry entry so see if it already there, so to get round this problem we can go into the registry and remove the hotfixes corresponding entry.

1. Start the registry editor (regedit.exe)
2. Move to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix
3. Under this key will be a number of sub-keys with name of the Knowledge base article the hotfix is referenced by as the name, e.g. Q123456 (the True Colour adapter fix).
4. To get more details about the hotfix, select the key (e.g. Q123456) and look at the "Fix Description" value.
5. To remove NT's knowledge of the fix being installed select the specific hotfix you want to remove (e.g. Q123456) and select Delete from the Edit menu. Click Yes to the confirmation
6. Close the registry editor.

The fix is still installed on the system, all you have done is removed NT's knowledge of its installation so you will now be able to re-install the hotfix in the normal way.

Q. When will Service Pack 4 be released and what's in it?

A. The Release Candidate for Service Pack is currently with a small handful of testers (I'm one of them :-P) and its looking good. As for details due to the Non Disclosure Agreement all testers have to sign I cannot give details however I can tell you a limited NTFS 5.0 driver is included (the new version of NTFS supplied with Windows NT 5.0).

I would expect the final version to ship by the end of September.

Q. When should I reapply a Service Pack?

A. You should reapply any Service Pack (and subsequent hotfixes) whenever you add any system utilities/services or hardware/software. A good rule of thumb is if the computer says "Changes have been made you must shutdown and restart your computer" reapply your service pack before the reboot.

The only problem is once you reinstall a service pack, unless you uninstall then reinstall, you will lose the ability to uninstall it.

Q. What is Option Pack 4?

A. Due to a lot of public pressure, Microsoft agreed to no longer include any new functionality in Service Packs, but would rather produce a separate add-on which would update various option components.

Option Pack 4 is the first of these (to keep in step with Service Pack 4) and can be downloaded from http://www.microsoft.com/windows/downloads/contents/updates/nt40ptpk/default.asp or is supplied as part of MSDN. The download is about 27MB.

If you download from the web you have to download a special program, download.exe, which you then run which downloads or installs the software.

Included in Option Pack 4 are:

• Internet Information Server 4.0 (which used the new Microsoft Management Console which is standard in NT 5.0)
• Microsoft Transaction Server 2.0 (this is tied in with IIS)
• Microsoft Message Queue Server 1.0
• Internet Connection Services for Microsoft RAS
• Certificate Server
• Site Server Express
• SMTP Server
• Message Queue Server

More information can be found at http://www.microsoft.com/NTServer/Basics/WhatNew.asp

To install the Option Pack you must be running Service Pack 3 or above (I tested with Service Pack 4 and you get warnings that it has not been tested on Service Pack 4 but it works fine) and you must have Internet Explorer 4.01 or above.

Once you start the installation you should click Next to the introduction screen and you will then have two options

1. Upgrade Only
2. Upgrade Plus

If you select Upgrade Only then only existing components on the system will be upgrade to Option Pack 4 version, clicking Upgrade Plus allows you to install extra software.

If you select Upgrade Plus you can then choose which components to install. Items such as IIS have sub-components such as NNTP server (news) which you can optionally install.

Depending on the components you selected you will be asked some minor questions and then the machine will reboot.

Q. How can I tell which version Service Pack I have installed?

A. When a Service Pack is installed using the normal method (e.g. not just copying the files to a build location) the service pack version is entered into the registry value CSDVersion which is under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion.

The value is of the formal "Service Pack n", e.g. "Service Pack 4" but can have extra information if it is a beta or release candidate, e.g. "Service Pack 4, RC 1.99".

To check this from the command line you could use the REG.EXE Resource Kit supplement 2 utility:

C:\>reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\CSDVersion"
REG_SZ CSDVersion Service Pack 4, RC 1.99

Make sure you put the value in double quotes (").