Chapter 24: Windows NT 4.0 Service Packs

Abstract

This chapter discusses the Windows NT Service Packs and the steps involved in installing Service Packs 3 and 4, as well as the corrections and new utilities that are included.

---

In this chapter, I discuss the Windows NT Service Packs and the updates they provide. The steps involved in installing Service Packs 3 and 4 are described, as well as the corrections and new utilities that are included. Special emphasis is placed on installation factors for Service Pack 4, and the operational contingencies are also summarized.

INTRODUCTION TO WINDOWS NT SERVICE PACKS

Microsoft distributes updates to operating systems and applications in the form of Service Packs. A Service Pack is a compressed collection of files packaged in a self-extracting, self-installing executable program. The Service Packs are frequently available for downloading, or on a CD, or both.

The Windows NT Service Packs provide ongoing system enhancements as well as corrections to application, network, device, and system errors encountered in the real-time use of NT Server 4.0. Every new version of a Service Pack includes the fixes and enhancements that were contained in the previous version of that Service Pack. Microsoft has just released its fourth Service Pack for Windows NT, which includes corrections to the Windows NT 4.0 Option Pack, as well as other corrections and new features.

Included on the CD accompanying this book are lists of Microsoft’s technical articles on errors corrected in Service Packs organized by category and sorted alphabetically. These lists are provided on the CD in the \RESOURCE directory as SPfixes.HTM. The list cites the article name and Q-number relating to errors that were corrected in the Service Pack. The list for Service Pack 3 includes specific references to fixes done in Service Packs 1 and 2, as well.

The references to articles are organized into the following categories: Application, Device, Network, Printing, and System. Each section describes the errors related to that category (for example, network-related or printing-related) that were addressed by the different Service Packs. The articles for each category are organized alphabetically by title, and display the Q-number of each article in the Microsoft KnowledgeBase.

The errors that were corrected in Service Packs 1 and 2 are included within the appropriate section of the list.

To review Microsoft’s list of all KnowledgeBase articles concerning services packs sorted by Q-number, go to the following URL at Microsoft’s Web site.

   HTTP://support.microsoft.com/support/kb/articles/q150/7/34.asp

 

WINDOWS NT 4.0 SERVICE PACK 3

Service Pack 3 (SP3) includes all the fixes provided in earlier Service Packs, as well as interim fixes. Service Pack 3 is available in 40-bit (international) and 128-bit (North America) encryption support.

Changes Included in Service Pack 3

The Windows NT Service Pack 3 provides the following new features, in addition to the error conditions for which it has corrections:

 

• Enhanced message queuing—RPC Transport
• Improved encryption—CryptoAPI 2.0
• Improved graphics support—DirectX 3.0
• Enhanced database connectivity—ODBC
• Message and mutual authentication—SMB Signing
• Stronger passwords—Password Filtering
• Restricts Anonymous Access to Registry
• Strong Encryption for Passwords
• New Win32 APIs

 

Following are some changes and contingencies in Service Pack 3 that you should be aware of:

 

• Change to the DHCP database—The format of the database containing DHCP information has been changed in Service Pack 3. If you are using DHCP, backing up the DHCP directory before installation of Service Pack 3 is recommended. The DHCP directory is %systemroot%\system32\dhcp.
• SP3 or later may be required for an application—Many applications and services besides the Windows NT 4.0 Option Pack require that Service Pack 3 (or later) be installed on the server.
• Service Pack 3 must be reinstalled—For systems using Windows NT Service Pack 3, it is recommended that Service Pack 3 be reinstalled if you add or change system or application software, or change installed hardware devices. However, applications installed on the server may include newer common files that could be overwritten by the reinstallation of Service Pack 3. In these cases, you would want to keep the newer files, and when prompted, choose not to overwrite the new files. For instance, in a situation where you need to reinstall Service Pack 3 onto an existing IIS 4.0 installation, you should keep the newer IIS 4.0 files.
• Change in process to obtain the 128-bit Service Pack 3—The distribution of the 128-bit version of Service Pack 3 is limited to the United States and Canada, and must be specially ordered from Microsoft. The 128-bit version of Service Pack 3 is referenced as Part# 236-00789, and can be ordered by fax at (716) 873-0906 or by phone at (800) 370-8756 for around $20 (U.S.) including shipping and handling.
• NT maintenance required after Service Pack 3—Recovery and repair of your Windows NT installation after applying Service Pack 3 is addressed in the Microsoft KnowledgeBase article # Q146887.
• No PowerPC support—There is no support for the PowerPC provided in Service Pack 3.

 

 

Installing Service Pack 3

The Service Pack 3 is provided in a self-extracting executable file named nt4sp3_i.exe for the X86 platform, and nt4sp3_a.exe for the Alpha platform.

If you are installing Service Pack 3 from the Windows NT 4.0 Option Pack CD, insert the CD, and when the Option Pack installation display loads, click the Install link. Then, click the Service Pack 3 link appropriate to your platform, such as Windows NT Service Pack 3 (X86).

Alternatively, you can run the Service Pack 3 file from an Explorer window in the \WinntSP3\i386 (or \WinntSP3\alpha) directory on the Option Pack CD. If you are installing Service Pack 3 from another location, locate the Service Pack 3 file in an Explorer window and run the executable file for your platform. Running the installation this way skips you to step 3 below.

To install Service Pack 3 from the Windows NT 4.0 Option Pack CD, perform the following steps:

 

1. Click the Install Service Pack 3 link on the Option Pack installation screen.
2. A Confirm File Open dialog box is displayed, informing you that you have chosen to open the file from the CD, and asking whether to open the file or save to disk. This is a standard dialog box provided by the browser whenever an executable file is selected for opening. To continue installing the Option Pack, click the Open button.
3. The files are extracted from the compressed file on the CD into your temp directory, and then the Service Pack 3 is installed from those files.
   A Welcome dialog box is displayed, as shown in Figure 24-1, recommending a comprehensive backup and updating of the Emergency Repair Disk. To install Windows NT Service Pack 3, click Next.
   
   

   Figure 24-1: The initial Service Pack 3 installation dialog box.
   

4. The license agreement is displayed next, and Setup asks if you accept the terms of the license agreement. If you select No, the Service Pack will not be installed. To continue installing the Service Pack, click Yes.
5. The next dialog box, shown in Figure 24-2, requests that you select the type of installation, though it effectively gives you only the option to install the Service Pack, or to uninstall a previously installed Service Pack. To continue installing the Windows NT Service Pack 3, click Next.
   
   

   Figure 24-2: Selecting the option to install or uninstall Service Pack 3.
   

6. The installation process then asks whether you want to create an uninstall directory for the Service Pack, as shown in Figure 24-3. Creating an uninstall directory takes additional space on the drive where Windows is installed. If you believe you may need to uninstall the Service Pack at any time, you should use the default setting of “Yes, I want to create an Uninstall directory.” If this is a new NT installation, or you believe that you would not need to uninstall the Service Pack, select the radio button next to “ No, I do not want to create Uninstall directory.” Once you have selected your uninstall option, click Next to continue installing Windows NT Service Pack 3.
   
   

   Figure 24-3: Choose whether or not you want an Uninstall directory created.
   

7. At this point you are presented with the last installation dialog box, as shown in Figure 24-4, prior to beginning the file copy process of the Service Pack 3 files. To stop the installation process, click Cancel. If you’re ready to install the Service Pack and begin the file copy portion of the installation, press Finish.
   
   

   Figure 24-4: Click Finish to install Service Pack 3, or Cancel to abort the setup.
   

8. You will then see the copying files dialog box appear as it copies over the Windows NT Service Pack 3 files to your NT system directory.
9. When all the Service Pack files have been copied, the ending dialog box appears, informing you that your system will be restarted, and that if you change or install any system components, you should reapply the Service Pack.
10. Click OK to restart your computer. Once your computer has restarted, if you are installing the Service Pack in order to install the Option Pack, restart the Option Pack installation process. An easy way to do this is to reinsert the Option Pack CD (which loads the installation in IE), click the Install link, and continue the Option Pack installation process.

 

WINDOWS NT 4.0 SERVICE PACK 4

Service Pack 4 (SP4) includes all the fixes provided in earlier Service Packs, as well as new fixes provided after Service Pack 3 was released. Service Pack 4 only provides 40-bit encryption support, but you can obtain a 128-bit version of Service Pack 4 from Microsoft at the Service Pack 4 download site (specified in the “Installing Service Pack 4” section later in this chapter).

Changes Included in Service Pack 4

The new fixes and additions to Windows NT Server 4.0 are organized in this section by the following categories: Network, Internet, Security, Programming, Administration, Option Pack, and System.

Some of the enhancements discussed in this section are only available on the CD version of Service Pack 4 or by separate download. Locations of components on the Service Pack 4 CD are referenced by their top-level directory (for example, \Mplayer2), though the executable for the Intel and Alpha versions of the components are provided in the \i386 and \Alpha subdirectories.

Network fixes and additions include:

 

• DNS fixes—Service Pack 4 corrects several known issues with DNS services and administration, as described in Q184693.
• DHCP fixes—Provides fixes to multiple errors described in Q184693.
• WINS enhancements—Service Pack 4 allows manual removal and multi-select operations of WINS database records, as well as WINS server burst mode handling.
• Extended IP API—Service Pack 4 includes the new IP Helper API, which supplies IP statistics and configuration information to networking applications.
• Updated RIP Listener—An update to the Routing Information Protocol Listener components.
• RRAS fixes—Service Pack 4 provides the RRAS Hotfix 3.0 update for an existing RRAS installation.
• IGMP v.2—Internet Group Management Protocol version 2, which a system can use to tell a router it is leaving the group
• FPNW support for Client 32—The Microsoft File and Print services for NetWare (FPNW) can now support Client32 from NetWare (NetWare’s 32-bit networking client).

 

Internet fixes and changes include:

 

• Tunneling DCOM over HTTP—Provides support for DCOM client/server interactions to take place through firewalls by tunneling DCOM over the HTTP port.
• DNS through proxies and firewalls—Service Pack 4 enables you to change the DNS server port (from the default of 53), and to use a different port number for outbound traffic through proxies or firewalls.
• I.E. 4 Service Pack 1—The Service Pack 4 CD includes the Service Pack update for Internet Explorer 4.01. The I.E. 4 Service Pack 1 is stored in the \MSIE401 directory on the Service Pack 4 CD.
• Updated NetShow Services—An updated version of the Microsoft NetShow Services is provided on the CD in the \NetShow directory.
• Updated Media Player—The new Microsoft Windows Media Player provides the features of the existing Media Player, as well as the Microsoft ActiveMovie and NetShow player. The new Media Player provides support for multimedia file types that include RealAudio 4.0 and RealVideo 4.0, as well as WAV, AVI and QuickTime. The new Media Player is located in the \Mplayer2 directory of the SP4 CD.

 

Security fixes and changes include:

 

• New security configuration utility—The Security Configuration Manager enables administrators to create and implement security configurations for systems running Windows NT.
• Improved Secure Channels—Service Pack 4 provides improvements to the secured channel protocols supporting communications encryption and integrity checking, as well as authentication.
• Enhanced security protocol—Service Pack 4 includes the new NT/LM security protocol dubbed NTLMv2. The NTLMv2 protocol provides substantive improvements in sessions security and authentication mechanisms.
• Security Log Access fix—Security privilege must now be specifically enabled to allow access to the security log in the Event Viewer.

 

Programming fixes and changes include:

 

• Update to Visual Studio—Service Pack 4 includes a Visual Studio update entitled the Visual Studio Analyzer Events, which enables you to graphically view system events, system performance, and system data.
• RPC improvements for Visual Basic—Enhancements were made to the Remote Procedure Call support for Visual Basic, supplying a new User Data Type (UDT) and a new interface IRecordInfo.
• Active Accessibility Support—The new Active Accessibility APIs allow programmatic access to all UI elements.

 

Administration fixes and changes include:

 

• Web-based administration support—The Web-based Enterprise Management (WBEM) support software is provided only on the Service Pack 4 CD.
• User profile quotas—Service Pack 4 provides a new utility called PROQUOTA.EXE, which enables you to set limits on the amount of disk space a user profile can use. This utility operates by monitoring a user’s profile size, and if a profile exceeds the limit, PROQUOTA.EXE forces the user to reduce the profile size before the user can log off.
• New Event Log features—Service Pack 4 provides three new system events: the Clean Shutdown Event, the Dirty Shutdown Event, and the System Version Event.

 

Option Pack fixes and changes include:

 

• Fixes and updates for server components—Service Pack 4 includes fixes and enhancements for the software components contained in the Windows NT 4.0 Option Pack. If Option Pack components are installed on your system, Service Pack 4 will update any installed Option Pack components. SP 4 includes updates for Microsoft Certificate Server (MCS), Index Server (IS), Internet Information Server (IIS), Message Queue Server (MSMQ), Microsoft Transaction Server (MTS), Simple Mail Transfer Protocol (SMTP), and Network News Transfer Protocol (NNTP). Service Pack 4 must be installed after the Option Pack is installed, for the Option Pack components to operate correctly. If you reinstall the Option Pack, you need to reinstall Service Pack 4.
• MSMQ Win95 Client fixes—Service Pack 4 includes fixes to the MSMQ client for Windows 95. The files are located in the \Support\MSMQ.95 directory.

 

System fixes and changes include:

 

• NTFS version 5—Service Pack 4 includes the new NTFS.SYS file, which provides limited support for drives formatted with NTFS version 5 (from NT 5). Certain features of NTFS v5 are still unavailable, including junction points, Encrypting File System (EFS), Native Structured Storage (NSS), and disk quotas. Accessing drives using these features from an NT 4 with SP4 machine will result in errors.
• Euro Key Patch—Service Pack 4 provides support for the new Euro currency symbol used in Europe.
• Fixes Year 2000 problems—Corrects known Y2K issues with User Manager, Date/Time control panel, Find files, DHCP administration, and Word document properties.
• Compaq Fiber Storage Driver—Includes the driver for the Compaq Fiber Channel Host Controller /E (EISA) and /P (PCI). The driver is located in the \DRVLIB directory.

Obtaining Service Pack 4

You can either download Service Pack 4 from the Microsoft Web site, or obtain it on CD. Some components are available only on CD (such as WBEM). Other updates you can download separately from Microsoft’s Web site (such as the Y2K fixes and Internet Explorer 4.01 Service Pack 1).

Service Pack 4 can be downloaded from the following URL:

   HTTP://www.microsoft.com/ntserver/nts/downloads/recommended/
   NT4SvcPk4/default.asp

The Service Pack 4 CD costs $21.59 (U.S.) including tax and shipping, and can be ordered by phone at (800) 370-8758 or via fax at (716) 447-7330. The Service Pack 4 CD can also be ordered at the following URL:

   http://www.microsoft.com/ntserver/nts/downloads/recommended/
   nt4svcpk4/ordercd.asp

When ordering the Service Pack 4 CD at the Microsoft Web site, you must have your complete Windows NT Product ID available, because Microsoft will request it when ordering the Service Pack 4 CD. The complete product ID can be accessed by right-clicking My Computer on your NT machine, and selecting Properties. The complete product ID is the number specified under Registered to.

 

The 128-bit version of Service Pack 4 can be ordered by phone (specify part number 236-01176), or downloaded by Canadian and U.S. users of Windows NT from the following URL:

   HTTP://mssecure.www.conxion.com/cgi-bin/ntitar.pl

Microsoft also provides the following option for you to install Service Pack 4 across the Internet using your Internet Explorer 3.0 or later Web browser. However, unless your Internet connection is exceptionally reliable and high-speed, this method may not be recommended.

   HTTP://support.microsoft.com/support/ntserver/content/
   servicepacks

 

Installation Issues of Service Pack 4

There are a number of conditions which, when installing Service Pack 4 over existing applications and system components, or uninstalling Service Pack 4, may result in the malfunction of the application or the system as a whole. Because of this, you are encouraged to read the entire README.TXT file that comes with Service Pack 4. Some of these common conditions are summarized as follows.

Administrative Issues

An administrator must consider the following factors when installing SP4, original NT 4.0 files, and applications:

 

• Using Emergency Repair Disk requires reinstalling SP4—The Emergency Repair Disk uses files from the Windows NT distribution CD to repair the NT installation. If you have to use the Emergency Repair Disk, you will be required to reinstall Service Pack 4. This process requires the SETUPDD.SYS file contained in Service Pack 4.
• Adding hardware or software may require reinstalling SP4—When you add or modify existing hardware or software components, you may be required to reinstall Service Pack 4. If your change to the system components uses files from the Windows NT distribution CD, or installs outdated versions of system files or drivers, you will have to reinstall Service Pack 4.
• Windows NT 4.0 Option Pack installation requires reinstall of Service Pack 4—If you install the Windows NT 4.0 Option Pack after you’ve installed Service Pack 4, you must reinstall Service Pack 4. The MSMQ MQIS controller installation will not complete without reinstalling Service Pack 4.
• Remote admin requires SP4 on remote server—To allow the remote administration tools to work on a remote server, in addition to the local machine running with Service Pack 4, the remote server must also be upgraded to Service Pack 4.

 

Application Issues

The installation factors with SP4 and a number of applications are briefly described as follows:

 

• Site Server Express issues with Y2K fix—When the Y2K update is run, a couple of virtual roots needed by the Posting Acceptor are not created. You will need to reinstall the Site Server Express 3.0 components from the \SSX directory on the Service Pack 4 CD for Posting Acceptor to work correctly.
• Uninstalling IE 4.x after SP4 is installed uninstalls some components—After installing Service Pack 4 on a system with Internet Explorer 4.x, if you uninstall IE 4.x you will uninstall some of the CryptoAPI components. To replace the missing CryptoAPI files, you will need to reinstall Service Pack 4.

 

Microsoft Certificate Server Issues

A number of Microsoft Certificate Server (MCS) issues with Service Pack 4 should be noted:

 

• Don’t install MCS on Feb. 29 on a leap year—According to Microsoft, installing MCS on February 29 of a leap year will cause the validity period for the server to be specified incorrectly. If it is currently February 29 of a leap year, change the system date or wait one day before installing MCS.
• Don’t install MCS on top of SP4—If MCS is installed on top of SP4, services–may fail to start due to timeout errors, and Microsoft states in the README.TXT that there is no workaround for this problem. So, if you are going to use MCS on a server, you should install MCS before upgrading it to SP4.
• Don’t use the HMAC algorithm—During installation of MCS, you can select the hash algorithm used by MCS during generation of certificates. Selecting the HMAC hash algorithm option will cause the MCS installation to fail.

 

IIS 4.0 Issues

There are several technical considerations with IIS 4.0 and Service Pack 4, which are summarily described as follows:

 

• IIS Root certificate may need to be reinstalled—Root certificates provided by Certificate Authorities other than those included on Microsoft’s default list (for example, Microsoft, VeriSign, and Thawte) must be reinstalled following the installation of SP4. This is required for support of MCS. The specific installation process for a CA certificate is slightly different after installing SP4; the new steps in this process are described as follows.

   

  To reinstall a CA certificate after SP4 installation:

   

  1. Access and open the certificate in IE 4 (on disk, or at the Certificate Enrollment Web Page).
  2. Select the option to open the file from its current location and click OK.
  3. In the Certificate dialog box, click Install Certificate, which invokes the Certificate Manager Import Wizard (this is new to SP4).
  4. Click Next to continue. Select the option to place the certificate into a specified certificate store, and click Browse.
  5. Click the Show Physical Stores checkbox.
  6. Click the + to expand the Trusted Root Certification Authorities node.
  7. Select Local Computer, and click OK.
  8. Click Next.
  9. Click Finish to complete the reinstallation of the certificate.
  10. A message is displayed, stating that the import was successful. Click OK.
  11. You must restart the IIS server for the CA update to take effect.
• CryptoAPI extensions may need reregistering—If you install IE 4.x after SP4, you will need to reregister certain CryptoAPI extensions (such as .CRT, .CER, and .DEF). Use the following syntax at the command line to reregister the file extensions:

 

 

REGSVR32 CRYPTEXT.DLL

 

 

• Global.asa file must be in application root—Previously in IIS 4.0, the global.asa file for an application could be located within a virtual directory. After installing SP4, the global.asa file must exist within the application root directory.

 

Issues with Uninstalling Service Pack 4

Several issues with uninstalling Service Pack 4 can have substantial effects on the functionality of your NT system. Uninstalling Service Pack 4 can be performed from the Add/Remove Programs control panel, or by running the SPUNINST.EXE in the \%systemroot%\$NtServicePackUninstall$\spuninst\ directory.

The capability to uninstall will only be available if the option to back up files necessary for uninstalling was selected during the Service Pack 4 installation.

Here are some of the issues involved in uninstalling SP4:

 

• Boot drive must remain stable for uninstall—For the uninstall option in Service Pack 4 to work, the boot drive on your NT machine must remain the same. If the boot drive is changed after SP4 is installed, you will not to be able to uninstall SP4.
• SP4 changes the SAM database—The Service Pack 4 installation process changes the SAM database, which will prevent previous versions of some DLLs and executables from being able to use the SAM database. Key system files that are upgraded during SP4 installation support these changes. Consequently, the SP4 uninstall process will not restore the original versions of the following files (because this would leave the SAM database inaccessible):

 

 

SAMLIB.DLL, SAMSRV.DLL, LSASRV.DLL, MSV1_0.DLL, WINLOGON.EXE, and SERVICES.EXE.

 

Caution: If you perform a reinstallation of Service Pack 3 after having installed and uninstalled Service Pack 4, do not overwrite the files specified above. If you overwrite these files, it will prevent access to the SAM database, and you will not be able to log on to your NT computer again.

 

• Uninstalling SP4 may disable cryptography—If you uninstall Service Pack 4 when your system previously had Service Pack 3 and did not have Internet Explorer 4.01, cryptography will not operate properly. You will need to reinstall Service Pack 3 before your cryptography will function accurately.

 

Hardware-specific Issues

There are several specific hardware compatibility issues in connection with SP4 installation. These are summarized as follows:

 

• More than 8 SCSI LUs requires registry entry—Windows NT with Service Pack 4 can now support more than 8 Logical Units on a SCSI device if a registry key is added. Add the key LargeLuns with a REG_DWORD value of 0x1 into the registry path specified below.


\HKEY_LOCAL_MACHINE\System\CurrentControlSet\<DriverServiceKey>\ Parameters\Device<n>


• The <DriverServiceKey> is the SCSI driver name.
• The Device<n> is the SCSI bus number (for example, Device1).
• Silicon Graphics needs additional files—To correctly install Service Pack 4 onto a Silicon Graphics system, you need to obtain additional files from the Silicon Graphics Web site at the following URL.


http://support.sgi.com/nt


• May lose Number Nine Visual Technologies Imagine 2—When installing Service Pack 4 over Service Pack 3, you may lose high-color resolutions (anything over 256 color depth).
• Need SystemSoft Card Wizard version 2.x—Before installing Service Pack 4, you must get the SystemSoft Wizard version 3.00.01. If you install Service Pack 4 onto a computer containing SystemSoft Card Wizard 2.x, the NT operating system will no longer be operational.
• NEC Versa 6050 or 6200 must replace HAL—If you have an NEC Versa 6050 or 6200 notebook computer, you must replace the HAL.DLL file during installation of Service Pack 4. You will be asked during the installation if you want to replace this file. Click Yes when prompted.
• IBM PS/1 Valuepoint computer needs Y2K fix—The IBM PS/1 Valuepoint computer has Y2K problems with Windows NT 4.0 that must be rectified by installing a new version of NTDETECT.COM. This file is located in the \PS1 directory on the Service Pack 4 CD.

 

Installing Service Pack 4

When you get ready to install Service Pack 4, you may first want to review Microsoft’s suggestions for what you should do prior to installation. In the README.TXT file describing Service Pack 4, Microsoft recommends that you perform the following before installing Service Pack 4:

 

• Stop all debugging sessions (if employed).
• Remove Advanced Power Management (if employed).
• Update the Emergency Repair Disk.
• Create a comprehensive backup of all system contents including registry.
• Disable any drivers and services that are not required to boot the system.
• Obtain the latest drivers for your hardware from vendors.
• Reboot the system immediately prior to installing Service Pack 4.
• Use Event Viewer to verify the system is currently operating without errors.

 

Once you have finished the checklist, you are ready to install Service Pack 4.

Service Pack 4 can be installed from a CD or by downloading it. Although you can get the core SP4 via download, the SP4 CD contains additional components. The SP4 CD includes the base Service Pack 4 contents, as well as several additional components that may be installed separately. In addition to SP4, the SP4 CD contains Windows NT Server NetShow Services, Media Player, Internet Explorer 4.01 Service Pack 1, Microsoft Web Based Enterprise Management (WBEM), Microsoft Site Server Express, Microsoft Data Access Components 2.0 Service Pack 1, and the Security Configuration Editor.

To install Service Pack 4 from CD, use the following steps:

 

1. Insert the SP4 CD, and the autorun loads the browser-based installation page, as shown in Figure 24-5. If the autorun fails to load the start page, go to your CD-ROM drive in an Explorer window and double-click the NTsp4.HTM file.
   
   

   Figure 24-5: Insert the Service Pack 4 CD, and click the Install Service Pack 4 link.
   

2. To install Service Pack 4, click the link entitled Install Service Pack 4.
3. A file download dialog box is displayed. Select Open this file from its current location, and click OK to continue.

 

Note: If you are installing Service Pack 4 from download, double-click the downloaded file in an Explorer window (NTSP4I.EXE for Intel or NTSP4A.EXE for Alpha). The Service Pack 4 files are extracted to the \TEMP directory, and will begin installation with the License Agreement dialog box described in step 4.

 

4. The License Agreement and installation option dialog box appears, as shown in Figure 24-6, presenting a checkbox to accept the License Agreement. This dialog box also includes a checkbox to back up the necessary files to allow a later uninstall of Service Pack 4 if desired. The uninstall option requires about 40MB of disk space. Clear this checkbox to disable the uninstall option. Click the Accept the License Agreement checkbox, and then click Install to continue Service Pack 4 installation.
   
   

   Figure 24-6: Accept the License Agreement and click Install to set up Service Pack 4.
   

5. A Windows NT Service Pack Setup dialog box, shown in Figure 24-7, is displayed when the Service Pack Setup backs up existing files (if the uninstall option is selected) and copies new files. This takes a few minutes.
   
   

   Figure 24-7: The progress of the file backup and file installation process is displayed.
   

6. Once the files have been copied, a message is displayed prompting you to restart the system, and reminding you to reinstall Service Pack 4 if you install any components off the original Windows NT Server 4.0 CD. Click Restart to reboot your system.
7. A Windows NT Service Pack Setup message may be displayed after rebooting, informing you that to resolve Y2K issues for software installed on your machine, you need to install the following list of programs. The list of pro-grams may vary depending upon what software is installed on your system prior to running Service Pack 4. The additional updates are located on the Service Pack 4 CD in the directory referenced here:
   • Internet Explorer 4.01 Service Pack 1 ( \MSIE401)
   • Data Access Components 2.0 Service Pack 1 (\MDAC)
   • Site Server Express 3.0 (\SSX)

 

You can view the Y2K.TXT file by clicking Yes, or click No to continue. The Y2K.TXT file explains where to obtain the updates listed above, either from Microsoft’s Web site or from the Service Pack 4 CD. The executable file containing the Y2K Service Pack for the Intel platform is Y2KSP4I.EXE, and Y2KSP4A.EXE for the DEC Alpha platform.

The Year 2000 Service Pack is on the Service Pack 4 CD, and you can also download it from Microsoft at the following URLs:

FTP://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/
HTTP://support.microsoft.com/support/downloads/
HTTP://support.microsoft.com/support/ntserver/content/ servicepacks/

COMPONENTS ON THE SP4 CD

Along with the Service Pack 4 files, the SP4 CD contains additional software you may want to use. Improvements to Media Player and Internet Explorer are provided, as well as a Service Pack for the Data Access Components. Also included on the SP4 CD are NetShow Services, Microsoft WBEM, Site Server Express, and the Security Configuration Manager.

Microsoft Windows NT Server NetShow Services

The NetShow Services for NT Server enable you to provide audio and video content on your corporate network, or across the Internet.

Installing NetShow Services requires that you be logged on a user account with administrator privileges and that Windows NT Service Pack 4 be installed. NetShow Administrator also requires Internet Explorer 4.01 or later. Microsoft recommends that you read through the release notes (on the CD) before installing the NetShow Services.

To install the Microsoft Windows NT Server NetShow Services, follow these steps:

 

1. Insert the Service Pack 4 CD, and when the autorun loads the Web-based startup page, click Microsoft Windows NT Server NetShow Services. The display will scroll to the Microsoft Windows NT Server NetShow Services section. Click the NetShow Services information page link (highlighted in blue) to go to the installation page.
2. Scroll down to the Installing NetShow Services section, or click the Installing NetShow Services link on the left side of the page.
3. The Installing NetShow Services section has four different installation options, the first of which enables you to install the NetShow services and administration components. The next three options enable you to install the NetShow tools, SDK, and File Transfer Control components, respectively.
4. To install the NetShow Services and administration components, click the NSSERVER.EXE link for your platform (I386 or Alpha).
5. A file download dialog box is displayed. Select Open this file from its current location, and click OK to continue.
6. A NetShow server component setup dialog box informs you that it is about to install the NetShow server administration components. Click Yes to continue.
7. A license agreement dialog box is displayed. Read the license, and click Yes to continue.
8. Next, the NetShow files are extracted and copied to your server, and then a NetShow 3.0 installation dialog box displays the set of features NetShow provides. You are prompted to click Next to continue.
9. The NetShow setup requirements dialog box is displayed. If your server meets the requirements, click Next to continue the installation of NetShow services and administration tools.
10. You are then presented with an installation options dialog box, which enables you to select a complete installation or only the administration components. For the purposes of this example, select Complete Installation. Select your desired option and click Next to continue.
11. You are then prompted to provide the name of the installation directory. Select the directory in which to install the NetShow Services and click Next to continue. If the directory does not already exist, you are prompted to verify that you want to create this directory; click Yes to create the directory.
12. Next, you are asked to provide the content directory (the directory containing the Advanced Streaming Format .asf files). Select the directory and click next to continue. If the directory does not already exist, you are again prompted to verify that you want to create this directory; click Yes to create the directory.
13. You are then asked if you want to enable HTTP streaming, and if so, whether to enable it for unicast or multicast services. Do not enable HTTP streaming if you are using a Web server on this machine on port 80 (by default, the setup program won’t bind this to port 80).
14. The NetShow setup establishes an administrator account. You can either let setup create a NetShowServices account, or you can specify an existing account to use. Select the preferred administrator account and click Finish to continue.
15. The NetShow files are copied, and the NetShow components are installed. If you are running IIS on this server, you will be informed that the IIS services must be stopped so the NetShow ISAPI extension for logging can be installed. Click Yes to shut down the IIS service if prompted.
16. Once installation is completed, you are prompted to reboot your server. Click OK to restart your machine.

 

The NetShow services are managed via the administration tool available at Start Programs NetShow Services NetShow Administrator. The NetShow Administrator uses a Web-based interface to configure and manage the NetShow services.

The details of managing the NetShow Services are beyond the scope of this book. Refer to the online documentation provided via Start Programs NetShow Services NetShow Documentation for further information.

Microsoft Windows Media Player

The Microsoft Windows Media Player replaces the earlier multimedia clients ActiveMovie and NetShow Player. In addition to the .AVI, .WAV, and QuickTime formats, the Media Player now supports RealAudio 4.0 and RealVideo 4.0 formats.

To install the Microsoft Windows Media Player, insert the Service Pack 4 CD and click Microsoft Windows Media Player. The display scrolls to the Microsoft Windows Media Player section.

The following steps walk you through the installation of Windows Media Player:

 

1. Click the Install Windows Media Player link for your platform (highlighted in blue) to start the installation.
2. A file download dialog box is displayed. Select Open this file from its current location, and click OK to continue.
3. A Windows Media Player setup dialog box is displayed, Click Yes to continue with the installation.
4. A license agreement dialog box is displayed. Read the license, and click Yes to continue.
5. The Windows Media Player files are then extracted and copied to your server.
6. The Windows Media Player Setup Configuration Utility prompts you to select your Internet connection rate. Select the connection rate in the drop-down list, and click OK to continue.
7. The Configuration Utility continues installing Media Player components, and you are prompted to click OK once the installation is completed.
8. Internet Explorer is launched, and tries to load the Welcome message at the Microsoft Web site. At this point, the Windows Media Player is installed.

 

Microsoft Internet Explorer 4.01 Service Pack 1

Service Pack 1 for Microsoft Internet Explorer 4.01 is included on the Service Pack 4 CD.

To install Service Pack 1 for Internet Explorer 4.01, follow these steps:

 

1. Insert the Service Pack 4 CD and click Microsoft Internet Explorer 4.01 Service Pack 1. The display scrolls to the Microsoft Internet Explorer 4.01 Service Pack 1 section.
2. Click the Install IE 4.01 SP1 link for your platform (highlighted in blue) to start the installation.
3. A file download dialog box is displayed. Select Open this file from its current location, and click OK to continue.
4. The initial Internet Explorer 4.01 SP1 setup dialog box is displayed. Click Next to continue.

 

Note: From this point on, the process is essentially the same as installing the base Internet Explorer 4.01 software. To avoid duplication of identical steps, I’ll refer you to the place in this book where these steps and dialog box are detailed. To complete the walkthrough of installing the IE 4.01 SP1, after the preceding four steps have been completed, continue this process beginning at step 4 of the “Installing Internet Explorer 4.01” section of Chapter 28. Refer to Chapter 28 for details and dialog boxes used in installing Internet Explorer 4.01.

Microsoft WBEM

The Service Pack 4 CD contains the version 1.1 update to the Web Based Enterprise Management (WBEM) components.

To install the WBEM components for Windows NT, follow these steps:

 

1. Insert the Service Pack 4 CD and click Microsoft WBEM. The display scrolls to the Microsoft WBEM section.
2. Click the Install WBEM link for your platform (highlighted in blue) to start the installation.
3. A file download dialog box is displayed. Select Open this file from its current location, and click OK to continue.
4. The initial Web Based Enterprise Management setup dialog box is displayed. Click Next to continue.
5. The WBEM files are then installed onto your server in the %systemroot%\system32\WBEM directory. Once the installation is completed, you are prompted to click Finish to exit setup.
6. You are then prompted to reboot your server. Click OK to restart the server.

 

Installed WBEM tools can be accessed in the %systemroot%\system32\WBEM directory.

The details of using WBEM are beyond the scope of this book. For further information, refer to the Web Based Enterprise Management technical materials provided at the Microsoft Web site. The following URLs provide a starting point for finding data on WBEM:

http://www.microsoft.com/hwdev/manageability/julywbem.htm
http://msdn.microsoft.com/developer/sdk/wbemsdk/
http://www.microsoft.com/management/wbem/default.htm

Microsoft Site Server Express

The Microsoft Site Server Express 3.0 upgrade component addresses Y2K issues in the SSE 2.0 version. Installing the SSE 3.0 upgrade requires that you have previously installed the Windows NT 4.0 Option Pack with Site Server Express 2.0.

To install the Microsoft Site Server Express component, follow these steps:

 

1. Insert the Service Pack 4 CD and click Microsoft Site Server Express. The display scrolls to the Microsoft Site Server Express section.
2. Click the Install Site Server Express link for your platform (highlighted in blue) to start the installation.
3. A file download dialog box is displayed. Select Open this file from its current location, and click OK to continue.
4. The Microsoft Site Server Express files are then extracted and copied to your server.
5. The initial Microsoft Site Server Express 3.0 setup dialog box is displayed. Click Next to continue.
6. The Completing Installation dialog displays a progress bar as the Site Server Express 3.0 files are installed.

 

Once Site Server Express 3.0 is installed, you can access the updated tools by selecting Start Programs Microsoft Site Server Express 3.0. For more information about Site Server Express 3.0, click Start Programs Microsoft Site Server Express 3.0 Documentation.

Microsoft Data Access Components 2.0
Service Pack 1

The Service Pack 1 for the Microsoft Data Access Components addresses Y2K issues, and is provided on the Windows NT Service Pack 4 CD.

To install Service Pack 1 for Microsoft Data Access Components 2.0, follow these steps:

 

1. Insert the Service Pack 4 CD and click Microsoft Data Access Components 2.0 Service Pack 1. The display scrolls to the Microsoft Data Access Components 2.0 Service Pack 1 section.
2. Click the Install Data Access Components link for your platform (highlighted in blue) to start the installation.
3. A file download dialog box is displayed. Select Open this file from its current location, and click OK to continue.
4. A license agreement dialog box is displayed. Read the license, and click Yes to continue.
5. The Microsoft Data Access Components 2.0 Service Pack 1 files are then extracted and copied to your server.
6. The initial Microsoft Data Access Components 2.0 setup dialog box is displayed. Click Continue to proceed with the installation.
7. The Microsoft Data Access Components 2.0 setup dialog box prompts you to select Complete or Custom installation. The Complete option installs all the Data Access Components; the Custom option installs the core Data Access Components, and enables you to select other drivers and providers. Select the desired option and click Continue to proceed with the installation.
8. Once the Data Access Components are installed, you are prompted to reboot your system to restart Windows. Click Restart Windows to finish installing the Data Access Components.

 

Microsoft Security Configuration Manager

The Microsoft Security Configuration Manager (SCM), also referred to as the Security Configuration Editor (SCE), is an administration tool that enables you to configure all security-related settings, and to store the settings in a centralized file. A set of example SCM configuration files are included on the Service Pack 4 CD. The SCM includes both command-line tools and an MMC-based interface.

The SCM is not installed during the Service Pack 4 installation—Service Pack 4 must be installed prior to installing the SCM. The Security Configuration Manager components are located in the \MSSCE directory on the Service Pack 4 CD. The \MSSCE\I386 directory contains the Intel-based version, and the \MSSCE\Alpha directory contains the DEC Alpha version.

Note: For detailed information on installing and configuring the Microsoft Security Configuration Manager, refer to the README.TXT file in the \MSSCE directory.

To begin installing the SCM, follow these steps:

 

1. Run the MSSCE.EXE file in the subdirectory under \MSSCE on the SP4 CD appropriate to your platform (either \MSSCE\I386 for Intel or \MSSCE\Alpha for DEC Alpha platform).
2. The Microsoft Windows NT Security Configuration Manager dialog box is displayed, verifying that you want to install the SCM. Click Yes to continue.
3. You are then asked if you want to install the Microsoft Management Console for the SCM. Click Yes if you want to use the MMC interface for the SCM.
4. A message is shown telling you that you may be requested to reboot your system, and to do so when asked. Click OK to continue.
5. A license agreement dialog box is displayed. Read the license, and click Yes to continue.
6. The SCM files are then extracted and copied to your server. Once all files are installed, you are informed that the setup was completed successfully. Click OK to continue.

 

Note: To install only the command-line tools, use the following syntax: MSSCE /C

To use the SCM in MMC, you must first load the Security Configuration Manager snap-in. To do this, start the MMC and select Add/Remove Snap-In from the Console menu in the MMC, click Add, and then select the Security Configuration Manager from the list of available snap-ins.

The first time the Security Configuration Manager starts, it will have no assigned database. When you click the Database node, the following message is displayed in the results pane:

‘The database you are attempting to open does not exist. Please choose Import Configuration from the
‘Database’ menu.’

The database it is attempting to open is %systemroot%\Security\Secedit.sdb, a file that does not yet exist.

You can create the Secedit.sdb database file using the following steps:

 

1. Right-click the Database node and select Import Configuration. Choose an existing configuration template to use as your starting point. Once the configuration is imported, the message changes to:

 

 

‘There is no analysis information...’

 

 

2. Right-click the Database node and select Analyze System Now. This process compares current system settings to those in the configuration you imported.
3. The Perform Analysis dialog box prompts you for the path to the Error log file. Select the path and filename, and click OK to continue.
4. The Security Analysis is then performed (which can take some time). Once this is completed, the %systemroot%\Security\Secedit.sdb file is created, and is selected as the current SCM database (this database will automatically be loaded when the Database node is selected in subsequent uses of SCM).

 

When the analysis is finished, click the Database node to display the seven security branches in the results pane, as shown in Figure 24-8. At this point, you can review and modify settings to meet your specific networking requirements.

Figure 24-8: The Security Configuration Manager snap-in and the default templates available for use

As shown above, two main branches of the SCM tree are available:

 

• The local Database branch holds the current settings for the machine and domain you are administering. The Database branch contains a set of configuration options, divided into seven security areas. These areas are Account Policies, Local Policies, Event Log, Restricted Groups, System Services, Registry, and File System. Because each category contains many settings, you should carefully explore what is available before altering any security assignments. Each individual setting may have a small symbol on its icon (either a green check or an X in a red circle), indicating whether the local computer is in compliance with the default setting for this policy. This provides a means of quickly auditing compliance with given policies directly from the SCM console. You can save the changes to the database by right-clicking Database and selecting Save.
• The Configurations branch holds a set of security templates. The provided templates can be used for applying permissions, for auditing purposes, or for various types of security configurations. Each template can contain settings for the seven security areas in the database branch.
• You can customize your own configuration templates. To create a custom configuration, edit your configuration settings to meet your networking requirements, and then export the configuration by right-clicking the Database node and selecting Export Configuration. You are then prompted to name your configuration.
• When all of your settings are configured to meet your requirements, you can implement them on your server. To apply configured settings to this server, right-click the Database node and select Configure System Now.

 

Caution: Be extremely careful when using the Security Configuration Manager—there is no “Undo” option available. You should test planned configurations thoroughly on a test machine or network before deploying them in a production environment.

The current version of the SCM is the first step in the ongoing evolution of Microsoft management tools for Windows NT (and Windows 2000). As we get into the Windows 2000 timeframe, you can expect further integration of system management functionality and many new configuration options to show up in such tools.

The details of using the SCM are beyond the scope of this book. Refer to the online documentation provided via the MMC Help menu Help on Security Configuration Manager for further information.

SUMMARY

This chapter provided a summary of the Windows NT Service Packs, with detailed focus on Service Packs 3 and 4. I described the corrections and new utilities provided by the Service Pack 3, and explained the installation steps. The Service Pack 4 features as well as its installation and operational contingencies were described, and the additional components on the SP4 CD were summarized.

<< Previous Page Next Page >>