I consider that we have "modern" PC, i.e. with Pentium 4 x86 32-bit CPU or later. Other requirements below:
sp6i386.exe -z -n -qor for Windows Terminal Server Edition
wtsi386.exe -z -n -qYou can inject it using WinImage in VHD-image.
---- start copying here ---- REGEDIT4 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Fat32] "Type"=dword:00000002 "Start"=dword:00000000 "ErrorControl"=dword:00000001 ---- end copying here ----And you must copy ntdlr, ntdetect.com from Windows 2000/XP/2003 root to the root directory (as usual it is C:\) of Windows NT installation. You can inject them using WinImage in VHD-image.
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00" multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo /sos
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00" /hal=halmps.dll /kernel=ntkrnlmp.exe multi(0)disk(0)rdisk(0)partition(1)\WINNT="Windows NT Workstation Version 4.00 [VGA mode]" /basevideo /sos /hal=halmps.dll /kernel=ntkrnlmp.exeIf we need to use more than 2CPU - you can patch NTKRNLMP.EXE to fix it, address may vary:
Comparing files ntkrnlmp.exe and NTKRNLMP.PTC 000000D8: 1A 91 000000D9: FA 72 000000DA: 0E 0F 000CA92F: 73 EB 000CAA9A: 74 EB .801CA910: 8B35B0261580 mov esi,[-07FEAD950] .801CA916: C1EE05 shr esi,5 .801CA919: F7D6 not esi .801CA91B: 83E61F and esi,01F .801CA91E: 46 inc esi .801CA91F: F605B726158004 test b,[-07FEAD949],4 .801CA926: 0F84B7000000 jz .0801CA9E3 --2 .801CA92C: 83FE04 cmp esi,4 .801CA92F: 730F jnc .0801CA940 --3 // change 73 => EB .801CAA84: 50 push eax .801CAA85: FF75EC push d,[ebp][-014] .801CAA88: 6A01 push 1 .801CAA8A: 689A000000 push 00000009A ;' š' .801CAA8F: E8CCCAF4FF call KeBugCheckEx --2 .801CAA94: 39352C3C1580 1cmp [-07FEAC3D4],esi .801CAA9A: 7419 jz .0801CAAB5 --3 // change 74 => EB .801CAA9C: 56 push esi .801CAA9D: A12C3C1580 mov eax,[080153C2C] .801CAAA2: 50 push eax .801CAAA3: FF35B0261580 push d,[-07FEAD950] .801CAAA9: 6A05 push 5 .801CAAAB: 689A000000 push 00000009A ;' š' .801CAAB0: E8ABCAF4FF call KeBugCheckEx --2Recalclute PE-header checksum after doing that!
sp6i386.exe -z -n -qor for Windows Terminal Server Edition
wtsi386.exe -z -n -q
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "PowerdownAfterShutdown"="1"