Back in 2004, Paul, Tom, and I worked on the Windows NT 4.0 and Windows 98 Threat Mitigation Guide. Now, Microsoft has made printed versions available for purchase from their web site. If you still need to use NT 4.0 and 9x in your environment, I recommend that you take a look at this document in any format (and no, I don't get royalties, so if you can handle the electronic version, that's perfectly fine with me!)