Programming Windows: Windows XP Service Pack 2 Interview (Premium)

Readers will remember Todd Wanke as the guy who ran Microsoft's War Room for Windows Server 2003, as chronicled in Programming Windows: War Room. Todd, you may recall, had pledged to never again run a War Room after the grueling Windows Server 2003 development process. "No way," he had said, laughing, when I had asked him then if he would do it again. "No way."

But in mid-2003, Microsoft needed Todd again, this time for what would ultimately prove to be the most secure client product that the company would ship to date: Windows XP Service Pack 2 (SP2). Recognizing how strategically important it was that Microsoft get this release right, he threw caution to the wind and signed on for what he initially envisioned as a three-month project.

Over a year later, Todd and a virtual team of Microsofties that worked outside of the usually strict hierarchical system at Microsoft delivered Windows XP SP2 to an eager audience. The SP2 product they shipped bore little resemblance to Microsoft's original plans for the release, but it was instead a far more secure and stable product that, ultimately, made XP a better operating system.

In early December 2004, I sat down with Todd, Ryan Burkhardt, and Jon Murchinson to discuss XP SP2 and the virtual team that made it happen. Here is their story.

Windows XP Service Pack 2: The early days
Paul: These stories always have a "Jim Allchin came back from vacation..." kind of start to them, but ...

[Laughter]

Todd: This was the SWI [Secure Windows Initiative] guys. After Windows Server 2003 shipped, I went over to the security group and was sitting on the 6th floor [of building 40], and I happened to be sitting with the SWI guys, which is our security response team. Blaster had just hit, Slammer had just hit, and there were a couple more in the queue.

Paul: A couple of new exploits?

Todd: Yeah, a couple of new exploits in the queue. George Stathakopoulos, who runs the SWI team, came into my office and asked what I was doing for the next couple of months.

[Laughter]

Paul: "Couple of months."

Todd: The initial vision of SP2 was not the SP2 that happened.

Paul: Right.

Todd: The initial vision was, we were going to enable the firewall, and we were going to ship it. And with that, I had a conversation with Brian Valentine in about June or July 2003, and then we had a series of executive meetings, with almost every Windows executive in the company. These were very large senior meetings with everyone there, from Jim [Allchin] on down, and there would be 30 to 40 people in the room and half of them were execs. And we really took a step back and said, OK, what is [SP2]? What are the current problems that we have, and what are the problems we can solve in the short term, mid-term, and long-term?

Todd: The initial vision of "just enable the firewall and ship it" started to get a little bit cloudy. That's because we did some initial application compatibility testing with ju...