Tired of gazing at that boring W2K-logo when booting? Here's a way to change that to your company logo or other even more fun things. This is also at the same time a tutorial about the W2K file protection system. When I saw that one of our Techs had done this, I asked him to write it up so here you go:

In order to modify the W2K startup logo you have to be aware of a few things up front:

1. The logo is a 16 color (not bit) bitmap that is 640 by 480 in size. It is built into the ntoskrnl.exe.
2. W2k file protection will not let you just modify this file and place it in the system32 directory, it will be overwritten shortly thereafter with the original.

It's a fairly simple program, just extract the files to a directory and run the exe. Once it's open, do a "File/Open" and select your ntoskrnl.exe. This is located in X:\winnt\sytem32.

You'll get 3 main folders, Bitmap is the one we want to work with. If you are on W2k Pro, it's under the directory "1" and is called "1033". If you run W2k Server, it's under "4" and is also called "1033". You'll see the current boot time logo.

Now you can do "Action/Replace Bitmap". Select the bitmap you have created to replace the old bitmap. Or, you could export the bitmap, modify it, then import it back in. It is very important that you do not deviate from 640x480 w/ 16 colors. Here is a nice gallery of already created images that could be downloaded and quickly converted to 16 color bmps:
http://www.littlewhitedog.com/reviews_other_00025.asp

In the Replace Bitmap browser once you have selected the new bitmap you'll need to select the bitmap number in the bottom right that you wish to replace. "1" for Pro and "4" for Server (or Adv Server).

Now you need to do a "File/Save As" and save the file somewhere on your drive. Do *NOT* save it in the same directory or it will be quickly snarfed up by Windows File Protection.

For the next step we'll need a tool that can open .CAB files as well as create them. I used WinAce: http://www.winace.com

Now you'll need to open the latest service pack .cab file that you have in your system. This file is located in X:\winnt\driver cache\i386 and will be called something like SP1.cab or SP2.cab. Extract the contents of the most current one to a directory. Now take your modified ntoskrnl.exe and drop it in that directory, it will overwrite the existing one.

Re-compress the all the files back into a .CAB and overwrite the original SP1.cab or SP2.cab (Back up the original first just in case). Then drop your modified ntoskrnl.exe into X:\winnt\system32\dllcache and X:\winnt\system32, in that order. This way Windows file protection has nowhere to get the original ntoskrnl.exe and leaves well enough alone. At this point, you can reboot.

You hose your system, it's not my fault... I've done it about 20 times on different systems and haven't had a problem yet. Special thanks to www.littlewhitedog.com and their forums for supplying much of the information in this report.