As of Windows 286, Windows ran in protected mode. No DOS APIs would work reliably in protected mode without being virtualized.
Console (command) windows have never run in Ring 0. That's kernel mode running with full trust. In NT, console windows used to be hosted in system service (CSRSS.exe) but console apps run with a user account and communicated with CSRSS via LRPC. I think Windows 7 split this into a separate console host eventually.
Windows NT never had any remnants of DOS.
The only thing really merged into Windows NT from the 9x codebase is the shell (explorer, control panels, applets, etc.). And that actually appeared first as an update to NT4.