Just wrote this answering a post in the XP Tweaks section so I figure I'll put this here too.
There are two keys in the NT registry that differentiate a server OS between a workstation OS. Normally, you can not change the values in these two keys.
The first key is
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Contro l\Product Options\ProductType
There are three possible values (as of NT4 and Windows 2000, could vary in .NET) that this key can have. If the value is WinNT, then it is considered to be NT Workstation, 2000 Pro, XP Home, or XP Pro. If the value is ServerNT, it's considered to be NT Server or 2K server. And if the value is LanmanNT, then it's Advanced Server (mabye .NET ADS too? I'm not sure)
The second key is
HKEY_Local_Machine\System\Setup\System Prefix
I'll just paste a quote from this article as to what that key does as it explains it far better than I could....
The SystemPrefix value is a binary value which the kernel treats as two DWORDs, of which the only important piece of information seems to be the bit represented by the mask 0x04000000 in the high-order DWORD. If ProductType is "ServerNT" or "LanmanNT", then this bit must be set. If ProductType is "WinNT" then the bit must be off (any inconsistency results in a blue-screen error at system boot).
You can't normally change the values in these two keys. If you do, Windows will give you this message:
"The system has detected tampering with your registered product type. This is a violation of your software license. Tampering with product type is not permitted."
You can change the keys yourself and watch what happens. From NT4 up Microsoft added safeguards into NTOSKRNL.EXE which watches these two keys. If the threads detect a change of the key, NT will give you the message above and change the values back. You can change them, click ok on the message, and manually do a refresh in the registry and see them changed back.
The way that NTSwitch gets around NTOSKRNL is this:
First it creates a dump of your entire NT registry. Then in the dump it will change the two keys, not in the registry actively being used. Then, once you reboot, it will delete the registry hives and replace them with it's altered ones.
From there, things get more complicated. NTOSKRNL, kernel32.dll, hal.dll, and a few other system files read the values of the two keys during boot.
If the value indicates a workstation OS, then the NT kernel is configured dynamically as a workstation during boot. This means 1 user logged onto the console at a time, limited version of IIS, only 10 HTTP connections allowed to the machine, BackOffice and other server apps won't install, etc.
If the value indicates a server OS, then the NT kernel is dynamically configured as a server. More than one user is allowed to be logged onto the console at the same time, server software will function (or just install as the case usually is and still function when you go back to a workstation setting), etc. Other things that vary in how the kernel is configured is cache sizes, ram usage policies, etc. as they will differ between what should be used for a workstation and what should be used for a server.
You won't find any other differences in the registry other than the two keys mentioned above. Everything else is done at kernel level.
In short, that's pretty much the only differences between a server and workstation version of NT, other than a few cab files missing on the workstation CD's for all the various servers and services that the server counterpart has, oh, and the $300 and up price tag
Linear Mode
