How Windows XP Handled Service Pack Uninstall Files

When updating Windows XP with a major Service Pack, the operating system retained a complete archive of replaced system binaries to allow users to roll back the installation if conflicts occurred. This article explains how Windows XP created, structured, and managed these uninstall files within the main Windows directory, how the rollback mechanism functioned, and how users managed the disk space these archives consumed.

Storage Location and Naming Conventions

During the installation of a Service Pack (such as SP1, SP2, or SP3), the update installer created a dedicated backup directory located directly inside %SystemRoot% (typically C:\WINDOWS).

For complete Service Packs, this folder was typically named:

  • C:\WINDOWS\$NtServicePackUninstall$

Individual hotfixes and security patches followed a similar naming pattern, using the format $NtUninstallKBxxxxxx$, where "xxxxxx" represented the specific Microsoft Knowledge Base article number.

Attributes and File Compression

To prevent accidental modification or deletion by standard users, the operating system applied both "Hidden" and "System" file attributes to the $NtServicePackUninstall$ directory. As a result, the folder was invisible under default Windows Explorer settings unless the user manually enabled the option to display hidden files, folders, and protected operating system files.

Because Service Pack backups contained hundreds of megabytes of system files, Windows XP leveraged NTFS file compression on these directories by default. Folders and files with NTFS compression appeared with blue text in Windows Explorer to signify that the files were compressed on-disk to conserve storage space.

Contents and the Rollback Mechanism

The $NtServicePackUninstall$ directory functioned as a standalone restore point containing:

  1. Replaced Binaries: Original copies of critical executable files (.exe), dynamic link libraries (.dll), drivers (.sys), and core components that were superseded by newer versions.
  2. Registry Backups: Snapshots of modified registry entries, stored within configuration files and hives, to restore system settings to their pre-update state.
  3. The Uninstallation Engine: A subfolder named spuninst, which contained the uninstallation script (spuninst.inf) and executable (spuninst.exe).

When a user selected the Service Pack for removal via the "Add or Remove Programs" applet in the Control Panel, the system invoked spuninst.exe. This process read spuninst.inf, restored the archived files to their respective locations (such as C:\WINDOWS\System32), applied the backed-up registry values, and registered the previous file versions.

Deletion and Reclaiming Disk Space

Once a Service Pack proved stable, the backup files were no longer functionally necessary. Windows XP provided two main ways to handle the accumulated storage:

  • Manual Deletion: Users could display hidden system files, manually delete the $NtServicePackUninstall$ directory, and remove the corresponding registry entry under HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall. If a user deleted the folder without removing the registry key, attempting to uninstall the update via "Add or Remove Programs" produced an error stating that the uninstallation files could not be found, prompting Windows to remove the orphaned entry from the list.
  • Disk Cleanup Integration: In later updates and configurations, the native Windows Disk Cleanup utility could identify and remove obsolete Service Pack backup files, permanently committing the installation to the current version while safely freeing hundreds of megabytes of drive space.