In this article I would like to present you the way the NT based operating system handle DOS and 16-bit Windows programs. It is really interesting and the subsystem which takes care of this is really a Good Piece of Software (TM) :-)
You prolly tried to run some old apps or games on your NT box, sometimes you were succesfull, sometimes not. Why the hell doesn't my old good game run on my NT machine and by my friend on Win9x it does? you say maybe to yourself. Well NT operating system was designed with security in mind (yeah :-)). That means, that processes don't share their memory (at least the writeable part of it, with some exceptions of course), if one process crashes, it won't crash the entire operating system or different independent process. You don't have write access to the IDT thus you cannot easily get into ring0 and you cannot directly access I/O ports.
Since most DOS and 16-Bit Windows progs don't only use the defined DOS/Windows api but use nasty hacks that talk directly to the hardware and/or access different processe's memory they simply cannot run under Windows NT without violating one of it's main base stones. Thatswhy some kind of jailbox, a virtual machine, is used in Windows NT based operating systems.