What became of Windows Cairo

[jimmsta]

I feel as though no one has ever really dug in to the various leaked bits of NT code and really done a deep dive into certain bits that made NT 'go'. I've spent the last couple weeks on and off, reading through bits of NT 3.51's code, which led me to a few pointers in search of Cairo. That particular leak is RC2 of NT 3.51, as far as I know. As such, it wasn't fully stripped of Cairo bits - OFS is in there, and within the code for the Object File System, a lot of interesting tidbits can be learned. Primarily, while it appeared as a separate filesystem, it does not have any kernel-level drivers. It instead, runs entirely in User-Mode. It appears to be nearly an implementation of Bitmapped FAT - but does not store anything on disk with your typical FAT formatting. It contains an index, bitmap, and list of "onodes", which appear to be 'object nodes'. Each 'file' is stored as a data stream, encapsulated inside a virtual FAT disk, of which, there can be multiple virtual FAT data streams stored as drive objects on the single OFS volume. The objects in question are OLE data streams. Instead of files, each bit of data saved to an OFS volume is composed of OLE objects, with corresponding data and metadata saved alongside the data stream.

In this case, NT 3.51 was mostly an update for the 1.0 release (3.1) of NT. It did, however, appear to add the OLE 2.0 stack, which at the time was still called CairOLE. The first iteration of Cairo was as the OLE 2.0 development effort. Chicago's cabinet and eventual Explorer were written entirely in CairOLE code. By NT 5, CairOLE was merged into the rest of the OLE OS components, as OLE32. * OLE 1.0 was implemented in Windows 2.0 in 1986, with further development through 1993. OLE 2.0 development appears to have started along with NT in 1988. *

In the various comments and text files in the 3.51 leak, there is talk about how "things will change heavily once Daytona ships". Daytona being the codename for NT 3.51, it seems they were waiting on Daytona to be completed before Cairo became an official project. There is mention of Cairo being the next project in the comments as well. NT 3.51 shipped, and NT4 development began. Cairo was a larger project for a much later release.

What became of OFS?
Cairo’s development took place as a future version of NT beyond NT 4. At least that seems to be where it laid, even in the NT 3.51 era. It was poised to become not the next, but the next-next release of NT. OFS was poised to become the de-facto filesystem for storing metadata and data side-by-side, which would be implemented in a slightly less obvious way over the 5 years of development that Cairo went through.

5 Years!? Yes. Cairo didn’t die with that one NT 4 build that has the OFS driver functional. No, that may have been one of the last builds with OFS exposed to the user, though. Cairo wasn’t just OLE 2.0/32, but a new way to build software using every new bit of kit that NT had to offer. Cairo was still the “Cairo Vision” that Gates had, with an internet-connected desktop. It also laid the groundwork for a lot of things we take for granted today.
OFS’s tech was re-worked with the JET database, introduced in NT5. It became the basis of something that is often overlooked in the beta community, it seems, because only sysadmins ever interact with this side of NT – Active Directory.

Where’s Cairo in all this?
Cairo was internally re-named “OLE DB/OLE DS” at some point between 1995-1999. The internal API’s that Cairo exposed were all preficed with “C” in their names, originally being “Cai”, or “Cairo”. The NT5 shell internally is named “CCshell”, while the original Cairo shell was simply “CShell”. There’s a handful of Cairo still running behind the scenes on NT 10, yet no one knows it.
OLE DB is Jet Database with OLE 2.0, while OLE DS is the Domain Services that are built on top of OLE 2.0/32. This is what became of Cairo. The Cairo project appears to have internally been this attempt to get every single aspect of users and their data to become manageable objects and metadata. The best example of this tech working is in every single Active Directory domain that exists today.

The Cairo vision was realized with NT 5.0’s release. Whatever came afterwards was just revitalization and keeping things up-to-date with modern software practices. Each new release of Windows tries to strip out the old OLE stuff with new .NET-based tooling, but the underlying technology they are replacing came from CairOLE. That said, WinFS was OFS re-implemented with .NET objects. Again, it ran on top of NTFS, but I’m not sure if it was entirely user-mode or had a kernel-mode driver (someone should look into that!).

As for API’s that came from Cairo, they’re still in there, doing their job. There’s even apps that you or I have probably run, and had no idea they stemmed from Cairo – calcs.exe, for instance, which sets ACL’s on files – it was a Cairo API tool. Most system tools that have a ‘c’ prefix are, in fact, Cairo. They still exist in Windows 11, and will likely exist long after its demise (although, I suspect most of them have been re-tooled for .NET at this point in time).

If you wish to take a look for yourselves, the srv03rtm folder has a subfolder for base\ds. Take a deep dive into the router subfolder, and you'll find every bit of Cairo that ever shipped in Windows NT 5.x. The 'domain server' component of Windows NT 5 is literally Cairo. It's been sitting under our noses this whole time.
In a way, CairOLE may have been considered OLE 3.0 (there is 1-2 instances where Cairo is referred to as NT 0x300, with NT 4 as NT 0x200, as well as OLE3 being used at least once). It became COM+, which became .NET 1.0 eventually.

TLDR: Cairo is Active Directory, and it still resides in all versions of Windows since NT 5.0. OFS isn’t completely dead, either, as it became the technology for the Active Directory Database and Datastore. The timeline shown on https://www.betaarchive.com/wiki/index. ... soft_Cairo is correct - but it was not cancelled. It was rolled into NT 5, as Active Directory.

[dixieLH]

does office/word 97 indexing has anything related to cairo ?

[jimmsta]

With regard to Office, the products were built on top of OLE technology. A lot of products built by Microsoft from 1993 and on were built on top of OLE 1.0 and 2.0 tech. Internally, I believe Cairo was intended to be OLE 3.0, which eventually morphed in to COM+, which eventually led us to .NET.
Ultimately, the current Windows offering is trying to implement a little bit more of the 'Cairo vision' than has ever been possible to deliver before.
Each Windows 10 & 11 install is effectively a node on a larger Microsoft domain - completely transparent to the end-user. The push for Cloud PC now is closer to the idea they had in store for Cairo - an internet-connected machine that stores everything on the server, yet has the same experience as if you were sitting in front of the machine itself - is, in fact, what they wanted to deliver with Cairo's technologies. Everything is now managed code, which was what had to happen if they were ever going to get true portability working on NT, which - they've done now, with .NET and .NET core.

[rthdribl]

This is a very interesting analysis, which is compatible with what SwiftOnSecurity said some time ago: Microsoft wanted Active Directory to manage and store much more than it does today. AD was expected to be stretched "down to a file", which never happened. This puzzle explains the shift "wait a moment, this was supposed to be an object file system, not some huge database/catalog!".

However, I think you are (implicitly) overstating the role of .NET. Only a small part of Windows uses the .NET Framework and Core is not present within the OS at all. The significant rewrite of Windows into .NET never happened.

[AlphaBeta]

In fact, are you sure about the connection between CairOLE and .NET in the first place? After all, in true Microsoft fashion, there is this other thing called COM+ that did actually ship under that name but has nothing to do with .NET.

Also yes, WinRT might have been influenced by .NET in one way or another, but it is still inherently an unmanaged framework based on COM.

[JSB_123]

Thanks for this analysis; interesting to note how these components live on. Looking backwards, if there was any doubt that most of Cairo was AD despite the clear direction MSFT gave at the time the seminal 4.0.1175.1 leak provided enough proof. In order to install, you needed to configure the installation as a DC with an OFS partition to manage domain objects.

I'd also point to this really excellent history (from Steve Sinofsky, ex-MSFT) on Cairo's technologies and how they were integrated into various Microsoft releases at the time (95 got the Cairo shell, everybody got COM, and AD shipped with Windows 2000).

[jimmsta]

In fact, are you sure about the connection between CairOLE and .NET in the first place? After all, in true Microsoft fashion, there is this other thing called COM+ that did actually ship under that name but has nothing to do with .NET.

Also yes, WinRT might have been influenced by .NET in one way or another, but it is still inherently an unmanaged framework based on COM.

A mistake and speculation on my part.

The more I read through things, the more confusing it gets, though. CairOLE was the name of the COM folder up until NT 4. Internally, despite refactoring, the code for all things OLE refer to CAIROLE as the base directory for OLE 1.0 through OLE32 2.0 and 'other' un-versioned bits that became a platform of sorts for later bits, like COM+ and .NET to be built on top of.

Cairo was more than just OLE and Domain Services - It also encompassed Cluster functionality, Active Directory FileStore, Distributed File System, Cairoshl (the NT 5.0+ winlogon and shell) as well as interoperability services for Exchange and DNS services. The Chicago shell is built off Cairoshl.

Ultimately, Microsoft from 1991 and on seems to have had 3 different trees of NT in active development. NT itself identified as 1.0 for the 3.1 release, and 1.0a for the 3.5 release (this fork was called DAYTONA). NT 1.0a appears to have been a refactor of the original 1.0 release, with lots of improvements made to lock the servers down a bit more, and added lots of Chicago-era improvements -- Including the Shell Update for 3.51 that added the almost-complete Chicago shell update (Explorer).

NT (razzle), Daytona, Cairo - the trifecta to achieve the Cairo vision, over the course of a decade. Along the road to Cairo,

There are comments dating back to 1991 indicating Cairo was effectively the 'bleeding edge' and consisted of all the services that eventually made it in to NT 5.0's release. Object File System became the Active Directory File Store. (I believe the whole point of WinFS was to provide a localized version of Active Directory's file store).

It seems a lot of refactoring went on, mixing and matching various bits and pieces from every tree in production seems to have been allowed at times - comments indicate removal of 'old Cairo code', in comments dating to 1992, indicating that 'Cairo' was always in development. This sort of explains why we have 2 leaked Cairo builds that don't seem much different from other builds of NT 3.1 and 4.0. They were bleeding edge builds, with all the 'latest' code and experimental features enabled. The mainline NT in development would just have different makefiles to turn off CAIRO features, and use only the 'downlevel' CAIRO feature set.

Blackcomb is mentioned in code dated as early as 1997 - at that point, it appears that Blackcomb was 'pie-in-the-sky' ideas for a future release. Nowadays, we'd call this branch 'vNext'. LongHorn was already in development as far back as 2001 (comments about merging code from LH into Whistler are where I get this from), while Whistler was in Release Candidate status. Blackcomb took the reigns up from Cairo and became the next-next release tree.

Windows 9x was also receiving so-called 'downlevel' binaries compiled from these NT releases - Chicago appears to have had its own fork of Razzle (Razzle95) to compile the OS on 9x or NT. I have not been able to find anything other than a reference or two to Razzle95 - no idea if it exists anywhere on the internet - I'm still holding out hope that Win9x code will be released for educational purposes.

Cairo was/is a set of features and guidelines that NT should have encompassed. It's only now that some of the far-reaching ideas are being implemented for the sake of security. NT 5.0's release seems to have closed the door on the Cairo codename, with future releases dropping codenames entirely, up until Whistler.

The platform that modern Windows is built from, started as parts of Cairo. It evolved over time to become what it is today, as everything else has done that has stayed above water.

edit: more digging, more weird things - in some cases, they mapped "cro" as a variable to represent cairo feature set enabling bits. There's lots of little bits in at least NT 5.2, but probably also NT4, given the timeline that the comments help paint. Most of what I'm referencing can be found on Microsoft-owned github.

[Emir214]

(snip)

There are comments dating back to 1991 indicating Cairo was effectively the 'bleeding edge' and consisted of all the services that eventually made it in to NT 5.0's release. Object File System became the Active Directory File Store. (I believe the whole point of WinFS was to provide a localized version of Active Directory's file store).

(snip)

Hi jimmsta.

I am reviewing documentation on Active Directory for the BA Wiki articles on Active Directory, WinFS, and Windows Cairo. Is there an "Active Directory File Store"? According to Active Directory Domain Services Overview on Microsoft Learn:

This data store, also known as the directory, contains information about Active Directory objects. These objects typically include shared resources such as servers, volumes, printers, and the network user and computer accounts. For more information about the Active Directory data store, see Directory data store.

From Directory data store:

The Active Directory directory service uses a data store for all directory information. This data store is often referred to as the directory. The directory contains information about objects such as users, groups, computers, domains, organizational units, and security policies. This information can be published for use by users and administrators.

And from Active Directory Architecture:

In the context of a computer network, a directory (also called a data store) is a hierarchical structure that stores information about objects on the network. Objects include shared resources such as servers, shared volumes, and printers; network user and computer accounts; as well as domains, applications, services, security policies, and just about everything else in your network. One example of the specific kinds of information a network directory might store about a particular type of object is that a directory typically stores a user's name, password, e-mail address, phone number, and so on, for a user account.

Files are not mentioned as objects that can be stored in the directory/data store. Any clarification and documentation would be helpful. Thank you very much.

[Emir214]

<snip>

In the various comments and text files in the 3.51 leak, there is talk about how "things will change heavily once Daytona ships". Daytona being the codename for NT 3.51, it seems they were waiting on Daytona to be completed before Cairo became an official project. There is mention of Cairo being the next project in the comments as well. NT 3.51 shipped, and NT4 development began. Cairo was a larger project for a much later release.

What became of OFS?
Cairo’s development took place as a future version of NT beyond NT 4. At least that seems to be where it laid, even in the NT 3.51 era. It was poised to become not the next, but the next-next release of NT. OFS was poised to become the de-facto filesystem for storing metadata and data side-by-side, which would be implemented in a slightly less obvious way over the 5 years of development that Cairo went through.

<snip>

Dave Cutler: Megan Bliss and I convinced Jim Allchin that we could do Tukwila and Cairo at the same time, that we had enough lab horsepower to do that. Of course, you know, I don't know why he bought this story, but he bought this story. We said, "here's what we'll do is you know we'll basically still have the two groups. We'll have the Cairo group, and we'll have the Tukwila group." He didn't like the name Tukwila and the T-shirt, I don't you remember the T-shirt it says

Dave Plummer (Dave's Garage): I was going to wear it tonight, it says

Cutler: It says, "Tukwila"

Plummer: We can get there from here yeah.

Cutler: We can get there from here. We would would put Priority getting Cairo out of the build lab first and then we get the rest of it out. And it turned out that every day, Tukwila, just came out every day and Cairo was always broken right. It took forever, and little by little the Cairo features didn't get done. And they never-- Ine of the things we did with with NTFS we said, "You guys can change the file structure as many times as you want, but you can't stop people from booting old systems and using old file structures. You have to either do an upgrade in place or you have to accept the old stuff. We're going to be dog food on this file system." The OFS guys never did that right to the very end, and they kept promising and promising. So they didn't get all of the the burn in--

Plummer: Right

Cutler: And eventually they missed a date. He said, "OFS is gone," say "that's gone". So little by little these features they just never delivered and they just never delivered and Tukwila just kept growing and growing and growing. And eventually the only thing that I can remember that we really brought over-- actually maybe two things: I think we brought over the Ser the file server software. I think that that replaced the NT one. And the other thing we brought over was Kerberos. Those are the only two things about Cairo, everything else was junked really, completely junked on the floor. Um it just wasn't there the people. Um I can't really I I guess I shouldn't really say anything there was a lot of good guys that worked on Cairo. Um and I don't I just don't think that the whole project had the focus and the desire to make it really great. And it just fell by the way because you know on the other side of the fence is the NT group, and they're not letting up. They got they're full on the throttle. And Megan did a great job of selling all this, we, it was I can remember the day we did this with Allchin. We in one of the conference rooms in building 36, and said "hey we could we'll just do-- Tukwila will just be a backup. It's just the backup. NT 4.0 I think is still one of the most popular ones that ever sold

Plummer: Yeah

Cutler: I ran to somebody I don't know a couple years ago that was still running N-- they still had NT 4.0 running on something. They still loved it.