Authentication Problems in Windows 2000 with NTLM 2 Levels Above 2 in a Windows NT 4.0 Domain (305379)
The information in this article applies to:
- Microsoft Windows NT Server, Enterprise Edition 4.0
- Microsoft Windows NT Server, Enterprise Edition 4.0 SP6a
This article was previously published under Q305379 SYMPTOMS
If a Windows 2000-based domain with NTLM version 2 levels above 2 is trusted by a Windows NT 4.0-based domain, authentication problems may occur. When you log on to a Windows 2000-based computer (as a member of the Windows NT 4.0-based domain), you can access shares on the primary domain controller, but not on any other member server in the trusted Windows NT 4.0-based domain.
Also, a Windows 2000-based cluster that is running the higher level of NTLM 2 does not authenticate a joining node if both nodes are part of a Windows NT 4.0 Service Pack 6a-based domain. The node that attempts to join the cluster does not succeed and the following error is recorded in the cluster log:
[JOIN] Unable to get join version data from sponsor "ip address" using NTLM package, status 5.
CAUSE
The token that is returned by the Windows NT 4.0-based computer has a TokenSize value that is less than the Windows 2000 token if the NTLM 2 level is set above 2. This causes the TargetName and TargetInfo values to be null. Windows NT 4.0 has a function for a logon target that does not allow a null server name with high security, which causes the authentication problems.
RESOLUTIONA supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem. To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site: Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.
The English version of this fix should have the following file attributes or later:
Date Time Version Size File name
-------------------------------------------------------
13-Sep-2001 19:30 4.0.1381.7097 188 KB Netlogon.dll
You must apply this file on the Windows NT 4.0 primary domain controller and backup domain controller.
NOTE: Because of file dependencies for Windows NT 4.0, this hotfix requires Windows NT 4.0 Service Pack 6a (SP6a) and the post-Windows NT 4.0 Service Pack 6a Security Rollup Package (SRP). For additional information, click the article number below
to view the article in the Microsoft Knowledge Base:
299444 Post-Windows NT 4.0 Service Pack 6a Security Rollup Package (SRP)
: Because of file dependencies for Windows 2000, this hotfix requires Microsoft Windows 2000 Service Pack 2 (SP2) and the hotfix that is described in the following Microsoft Knowledge Base article:
272129 Cluster Service Does Not Start on 'Joining' Node in Windows 2000 Cluster
WORKAROUND
To work around this problem, use a Windows 2000-based domain controller for the cluster nodes, or reduce the security for LmCompatibilityLevel to allow a join.
STATUSMicrosoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
| Modification Type: | Minor | Last Reviewed: | 10/18/2005 |
|---|
| Keywords: | kbHotfixServer kbQFE kbbug kbfix kbQFE kbWin2000PreSP3Fix KB305379 |
|---|
|