I experienced a problem on several of my machines when testing new patches. Windows would crash after installing the WM_TIMER (Q328310) patch. Un-installing the patch fixed stopped the blue screens in every case, however, the un-install failed on the Baan server and the patch had to be removed manually to stabilize the machine.

The WM_TIMER patch puts the following files under %SYSTEMROOT%\System32:

File Name Date Size
Gdi32.dll 11-Nov-02 169,744
User32.dll 11-Nov-02 326,928
Win32k.sys 9-Oct-02 1,254,992
Winsrv.dll 11-Nov-02 175,888

Add/Remove programs should roll the files back to:

File Name Date Size
Gdi32.dll 18-Nov-99 166,160
User32.dll 18-Nov-99 335,120
Win32k.sys 18-Nov-99 1,309,232
Winsrv.dll 18-Nov-99 166,672

(These files can be found in SP6a.)

If anyone else is experiencing problems with the WM_TIMER patch, please post your results here. I currently have a case open with Microsoft for this problem. Pooling your information with mine will help them fix the problem
with this patch if there is one.

Roy Nelson
CIO
HyPro Inc.

I have installed SP6a including Security Rollup Package on my NT4 machine without problems.

Good luck

Title: Flaw in Windows WM_TIMER Message Handling Could Enable
Privilege Elevation (328310)
Released: 11 December 2002
Revised: 07 February 2003 (version 2.0)
Software: Microsoft Windows NT 4.0
Microsoft Windows NT 4.0, Terminal Server Edition
Microsoft Windows 2000
Microsoft Windows XP
Impact: Privilege elevation
Max Risk: Important
Bulletin: MS02-071

Microsoft encourages customers to review the Security Bulletin at:
http://www.microsoft.com/technet/security/bulletin/MS02-071.asp
http://www.microsoft.com/security/security_bulletins/ms02-071.asp
- ----------------------------------------------------------------------

Reason for Revision:
====================
Subsequent to the release of this bulletin it was determined
that the patch for Microsoft Windows NT 4.0 machines introduced
an error that could, under certain configurations, cause NT 4.0
to fail. Microsoft has investigated this issue and is releasing
an updated patch for Windows NT 4.0. The bulletin has been updated
to include the new download links for the NT 4.0 patch. Customers
who have installed the patch on Microsoft Windows 2000 and Windows
XP are unaffected by this error.