Making sense of the Windows NT 4.0 Start menu banner claims

July 24, 2024 8 minute read

Dave Plummer, a former Windows engineer who you may know from his YouTube channel Dave’s Garage, recently tweeted the following:

Well, that’s interesting! It might seem like nothing these days - of course you can procedurally draw rotated text, why not? But you have to remember Windows NT 4.0’s minimum system requirements are a 486 at 33 MHz, 16 MB of RAM, and just any VGA graphics card that makes pixels appear on the screen. (VGA here refers to the 1987 IBM PC standard of 640×480 with 16 colors, not the “modern” VGA, specified by VESA, that stretches as far as 2048×1536 with 24-bit color.) The Graphics Device Interface (GDI) library’s performance was dramatically improved in NT 4, so it could plausibly make sense that even the lowest-end systems could draw the gradient and text very quickly. After all, Windows 95 with its minimum spec of 4 MB of RAM managed miracles such as drawing your desktop wallpaper - at 16-bit 1024×768, that would require about 1.5 MB, which could already be well in use by other programs.

In Dave’s tweet, and subsequent YouTube video, he mentions that Windows 95 simply had a pre-rendered bitmap of its Start menu banner logo embedded into explorer.exe. Indeed, you can find this bitmap pretty easily using a copy of Windows 95, 98, or Me, and a tool such as Resource Hacker:

Image displaying the Start menu banners used for each release of Windows 9x

And if we go past NT 4, to 2000, XP, Server 2003, and Vista (the classic Start menu was removed in Windows 7), we can also see that the banner is a bitmap:

Image displaying a significant number of Start menu banners in the above mentioned Windows releases, for the many different editions released. Vista only has one banner universal to all editions.

Ok, that’s a lot of editions (and I didn’t even include all editions of XP). Maybe they decided rendering with GDI at runtime didn’t make sense, so they went back to bitmaps.

The two key claims Dave makes about NT 4.0 are:

  • NT 4.0 comes in many editions, so there are already multiple brand names to consider.
  • Each language release of NT 4.0 needs its name localised.

Starting with the first claim, we can easily confirm that it appears to be incorrect.

The final release of NT 4.0 (and all service packs) only contains two banners: Workstation, and Server. There are also two later releases of NT 4.0 - Terminal Server and Embedded. Terminal Server simply overwrites the Server resource with the Terminal Server name, and Embedded adds a new resource. Amusingly, “Embedded” seems to have two nearly invisible letters: “Ed”. Maybe it was originally “Embedded Edition”?

Image displaying the four variants of the Windows NT 4.0 Start menu banner

Well, this still just doesn’t seem right. There must be some situation where the bitmaps are ignored, and a graphic rendered at runtime is used instead.

I poked at a copy of Windows NT 4.0 Workstation in Italian, and found the exact same bitmaps with English text. Maybe the bitmaps are just there for some compatibility reason?

So I installed this copy, and found the exact same English-language bitmaps.

Screenshot of the Windows NT 4.0 Workstation desktop, Start menu, and About Windows dialog in Italian

Nope - the branding stays identical. What about Server in Spanish?

Same screenshot as above, in Spanish for Windows NT 4.0 Server

Hm. English and other European languages were part of the initial release of NT 4.0. Chinese, Japanese, and Korean (CJK) were released later. Maybe it was added later to handle those languages. So let’s try Simplified Chinese Server.

Same screenshot as above, in Simplified Chinese

Let’s go for broke then - Japanese Enterprise Server.

Same screenshot as above, in Japanese for Windows NT 4.0 Enterprise Server

At this point we’ve confirmed that, in released builds of NT 4.0, the Windows branding doesn’t change with localisation, in fact rarely changes with the specific edition of the operating system, and no procedural rendering is being done.

That leaves one more theory - was the bitmap originally procedurally generated in NT 4.0 betas, and then, later, it became the two Workstation and Server bitmap resources?

Let’s turn back the clock to the development of Windows 95, the first time the Start menu, taskbar, and Explorer (the “shell”) were implemented in a capacity more than just a proof-of-concept. Alongside the MS-DOS-based versions of Windows, Microsoft were simultaneously working on Windows NT. There was some clear excitement for the Windows 95 redesign, and therefore demand for it to make its way to Windows NT. The project porting the Windows 95 shell to NT was named the Shell Update Release (SUR), and it was released as Windows NT 4.0. Microsoft also developed and released the Shell Technology Preview (aka NewShell), allowing an early build of the port to be tested on NT 3.51.

In the earliest leaked build of the Shell Technology Preview, 3.50.854, the banner says “Windows 95” on a grey background, almost identically to the banner found in Windows 95, but in what appears to be a Helvetica-alike font such as Microsoft Sans Serif, rather than the Franklin Gothic font used by the Windows brand between 95 and XP. By the time STP reaches its official preview release (of which two builds were released), the graphic is changed to say “Windows NT Explorer” on a bright blue background.

This NT Explorer graphic also appears in early leaked pre-beta builds of NT 4.0. In Beta 1, the bitmap changes to a grey gradient with a condensed font, also adding the edition of NT, “Workstation” or “Server”. It also has some random color sparkles. The final graphics appear in Beta 2, with a dithered blue to black gradient, and the correct brand font for “Windows NT”.

Image displaying the lineage of the Start menu banner in the development of Windows NT 4.0.
Did Windows NT 4 ever procedurally draw the Start menu banner?
No - it was always a pre-rendered bitmap!
NT 4 started as Shell Technology Preview, bringing Windows 95 Explorer to NT 3.51. The earliest leaked build, 854, uses a strange bitmap that doesn’t match the Windows 95 brand.
The final release build of STP uses a solid blue bitmap with “Windows NT Explorer” in italic. This also appears in the earliest leaked build of NT
4, build 1130.
In Beta 1, the bitmap changes to a grey gradient with a condensed font, also adding the edition of NT, “Workstation” or “Server”. Notably, there are some random color sparkles.
The final graphics appear in Beta 2, with a dithered blue to black gradient, and the proper brand font for “Windows NT”. “Workstation” and “Server” are still part of the bitmap, not rendered.

Finally, leaked source code of presumably RTM or a post-RTM release of NT 4.0 does not appear to contain any code to render the banners with GDI. The only code that has been found simply loads the bitmap resource for Workstation or Server.

In conclusion: From publicly available evidence, it does not appear that, at any point, Windows NT 4.0 ever used a procedurally rendered graphic.

So was Dave lying, did he just forget how it works, or is there more to the story we don’t know? Well, of course, it’s hard to tell. In one way, the SUR project was at least 29 years ago, with the earliest known Shell Technology Preview build being from November 1994, and I can definitely see memory failing to recall how it was put together all that long ago. In another, I’ve observed Dave to have an interesting way of describing his achievements, where it seems like some of it is truth, and some of it is embellished. This does feel a bit like it could be one of those, but again, all I can do is speculate. He’s had some clear contributions to Windows that, in my opinion, need no embellishment because they’re significant enough that millions of users have interfaced with them, and many still exist in the latest version of Windows 11 today, despite him leaving Microsoft in 2003. And indeed, Dave himself frequently mentions on social media that he is wealthy, published a book literally titled “Secrets of the Autistic Millionaire”, and closes his videos by saying he’s “just in it for the subs and likes”. There is also the possibility that the code never saw the light of day - never released, and never leaked.

I performed this exercise to understand whether, perhaps, something was missing from Dave’s story, or we were unaware of some necessary condition to invoke the procedurally-drawn graphic code path. With all of the above said, please do not harass Dave over this post. Unless he has some evidence we don’t, or that I missed, I don’t think it’s necessary to bug him.