The HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\CSDVersion registry subkey shows a value of Service Pack 6 if either Windows NT 4.0 Service Pack 6 (SP6) or SP6a is installed. The most common way to determine whether SP6a is installed on a system is to run the winver.exe utility. However, winver.exe is a GUI utility, so this method has great limitations for administrators who want to query remote machines to determine the systems' service pack levels.
I learned a curious fact about SP6a's winver.exe that can indirectly enable administrators to get the SP6a information they need. The winver.exe that comes with SP6a is hard-coded to display (in the GUI) an extra line below the copyright information that states "Revised Service Pack 6a." If you run this version of winver.exe on a machine running a service pack earlier than SP6, the GUI displays the correct service pack number in this extra line of text. When Microsoft releases SP7, Microsoft plans to replace winver.exe with a new version that doesn't display this extra line of text, so querying the timestamp of winver.exe should be a reliable method of remotely determining whether SP6a is installed. If the timestamp is 11/18/1999, then SP6a's winver.exe is installed; if the timestamp is 8/9/1996 or another date, some other service pack is installed. Listing 1 shows a batch file that parses a list of NT machines and queries each machine about whether SP6a is running based on winver.exe's timestamp.
—Matthew Bell
mbell@thedomaingroup.com
End of Article
