SYMPTOMS
Windows NT 4.0 with Service Pack 3 (SP3) installed provides the capability
to restrict anonymous users from obtaining system information. For more
information, please see the following article in the Microsoft Knowledge
Base:
143474: Restricting Information Available to Anonymous Logon Users
However, with RestrictAnonymous access enabled, anonymous connections are
able to obtain the password policy from a Windows NT Server. The password
policy defines the Windows NT domain policy with respect to the minimum
password length, whether blank passwords are permitted, maximum password
age, and password history.
Anonymous access to the password policy information is used by Windows NT
to provide end-users detailed error information under specific
circumstances. If the user is required to change their password at the next
logon, and the user enters a new password that is rejected because of the
password policy, Windows NT can tell the user why the password was
rejected. The password policy is obtained by the system before the user has
completed the logon and therefore uses an anonymous connection.
For example, assume there is a password policy that requires a minimum
password length of 8 characters and a history that remembers the last 5
passwords. If the user chooses a new password of 6 characters, or enters a
previous password, they see a detailed error message with the following
information:
Your password must be at least 8 characters long. Your new password
cannot be the same as any of your previous 5 passwords.
RESOLUTION
Microsoft has a fix available that disables anonymous access to password
policy information when the RestrictAnonymous access is enabled. When the
hotfix is applied and RestrictAnonymous is enabled, anonymous connections
cannot obtain password policy information.
Microsoft recommends installing the hotfix on all domain controllers that
have Service Pack 3 installed.
To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the
Microsoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack