WNT is not VMS
It is a nice urban story, that WNT is VMS + 1.
AFAIK, David Cutler was hardly involved with VMS during his time at Digital, probably with the design of VMS 1.0 and possibly with 2.0. But by the time NT came about, we were already at VMS 5.5-2 or perhaps 6.1, with huge improvements in the security domain.
There are similarities. Some.
F.ex. in the task scheduler, with the priority levels 0-15. Probably also in the handling of virtual memory and pagefile.
I don´t know much about the internals of NT, and I can´t say if and how there is memory protection and the like. But there is certainly not a role-based security like there is in VMS (whitch was there from te beginning, although perhaps with some bugs and oversights).
And I never heard of buffer overflows, until (also) VMS got crippled (a bit) with third party software that did not adhere to the rigorous parameter passing rules.
VMS was disigned to be a multi-user, multi purpose OS. NT is not, it is a desktop OS, single user but with some network connections taking part. To make it multi-user, they needed Citrix, but that is not native.
Don´t blame Cutler, he only made the kernel. That the rest of Microsoft did not understand what he did (or was aiming at) is not his fault.
Nevertheless, there are design decisions that were absolutely wrong. The registry is one of them.