Not just that but between 3.51 and 4.0 many NT drivers like graphics were moved to ring 0, trading performance for robustness.
For performance reasons it lived in the NT kernel, together with the Window manager (which also draws windows using GDI).
Vista moved to a compositing window manager, I believe that was the point when GDI moved fully into userspace, drawing into the new per-window texture buffer instead of directly to the screen. And of course Windows 7 introduced Direct2d as the faster replacement, but you can still use GDI today.
Only from NT 4 onwards.
NT 3.1, 3.5 and 3.51 ran GDI in user space.
NT 4 moved it into the kernel.
NT 5 (branded "Windows 2000") and NT 5.1 (branded "Windows XP") kept it there.
It is interesting to consider is as moving back out again; it never was, in my understanding, and even today in "Windows Server Core" it still has the window system built in.
But GDI was not so much moved back out of the kernel again as replaced in NT 6 ("Vista") with the new Aero Compositor.
In "classic" Windows and NT 4.0 - 5.2 GDI would draw directly into VRAM, possibly calling driver-specific acceleration routines. This is how infamous "ghosting" issues when parts of the system would hang happened.
With new model in Vista and later, GDI was directed at separate surface that was later used as texture and composited on screen. Some fast paths were still available to bypass that mainly for full screen apps, and were improved over time.
Windows needs to stop a service or restart one to apply updates in real-time. Ever watched the screen flash during updating on Windows? That is the graphic stack restarting. This is more present on slower dual and quad core CPU systems. Microsoft needed to do this to work around how they handle files.
Windows even wired HID event processing in the OS to verify that the display manager is running. If the screen ever goes black during updates, just plug-in a keyboard and press a key to restart it.
* There are ways to prevent a file lock when open a file in Windows but it not standard and rarely used by applications, even ones written by Microsoft.
mpv happily opens files while they are downloading, and they don't interfere each other.
> Windows even wired HID event processing in the OS to verify that the display manager is running. If the screen ever goes black during updates, just plug-in a keyboard and press a key to restart it.
Funny you mention this, I just have managed to set up my laptop to listen audiobooks. It was such a pain. I somehow disabled the windows lock screen, made a script that calls "nircmd monitor off" every 5 seconds. And with mpv I can listen audio in total dark, and change volume and seek position on the touchpad with gestures. It works, but it is probably cheaper to get an mp4 player with volume and jump back buttons