Description of the Credential Roaming service update for Windows Server 2003 and for Windows XP (907247)

MORE INFORMATION

Windows Server 2003 update information

A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows Server 2003 service pack that contains this feature.

To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

Prerequisites

Windows Server 2003 SP1

Restart requirement

You must restart the computer after you apply this update.

File information

The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.Windows Server 2003, Itanium-based versions

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Certmgr.dll	5.2.3790.2721	1,464,832	10-Jun-2006	04:46	IA-64	SP1	SP1QFE
Dimsntfy.dll	5.2.3790.2721	52,736	10-Jun-2006	04:46	IA-64	SP1	SP1QFE
Dimsroam.dll	5.2.3790.2721	116,736	10-Jun-2006	04:46	IA-64	SP1	SP1QFE
Pautoenr.dll	5.2.3790.2721	198,144	10-Jun-2006	04:46	IA-64	SP1	SP1QFE
Wcertmgr.dll	5.2.3790.2721	478,720	10-Jun-2006	04:46	x86	SP1	WOW
Wdimsntfy.dll	5.2.3790.2721	19,456	10-Jun-2006	04:46	x86	SP1	WOW
Wdimsroam.dll	5.2.3790.2721	40,448	10-Jun-2006	04:46	x86	SP1	WOW
Wpautoenr.dll	5.2.3790.2721	75,264	10-Jun-2006	04:46	x86	SP1	WOW

Windows Server 2003, x64-based versions

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Certmgr.dll	5.2.3790.2721	751,104	10-Jun-2006	04:45	x64	SP1	SP1QFE
Dimsntfy.dll	5.2.3790.2721	28,672	10-Jun-2006	04:45	x64	SP1	SP1QFE
Dimsroam.dll	5.2.3790.2721	64,512	10-Jun-2006	04:45	x64	SP1	SP1QFE
Pautoenr.dll	5.2.3790.2721	113,664	10-Jun-2006	04:45	x64	SP1	SP1QFE
Wcertmgr.dll	5.2.3790.2721	478,720	10-Jun-2006	04:46	x86	SP1	WOW
Wdimsntfy.dll	5.2.3790.2721	19,456	10-Jun-2006	04:46	x86	SP1	WOW
Wdimsroam.dll	5.2.3790.2721	40,448	10-Jun-2006	04:46	x86	SP1	WOW
Wpautoenr.dll	5.2.3790.2721	75,264	10-Jun-2006	04:46	x86	SP1	WOW

Windows Server 2003, x86-based versions

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Certmgr.dll	5.2.3790.2721	478,720	10-Jun-2006	04:29	x86	SP1	SP1QFE
Dimsntfy.dll	5.2.3790.2721	19,456	10-Jun-2006	04:29	x86	SP1	SP1QFE
Dimsroam.dll	5.2.3790.2721	40,448	10-Jun-2006	04:29	x86	SP1	SP1QFE
Pautoenr.dll	5.2.3790.2721	75,264	10-Jun-2006	04:29	x86	SP1	SP1QFE

Windows XP update information

A supported feature that modifies the product's default behavior is now available from Microsoft, but it is only intended to modify the behavior that this article describes. Apply it only to systems that specifically require it. This feature may receive additional testing. Therefore, if the system is not severely affected by the lack of this feature, we recommend that you wait for the next Windows XP service pack that contains this feature.

To obtain this feature immediately, contact Microsoft Product Support Services. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

Prerequisites

Windows XP SP2

Restart requirement

You must restart the computer after you apply this update.

File information

The English version of this update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Certmgr.dll	5.1.2600.2914	457,216	23-May-2006	11:54	x86	SP2	SP2QFE
Dimsntfy.dll	5.1.2600.2914	19,456	23-May-2006	11:54	x86	SP2	SP2QFE
Dimsroam.dll	5.1.2600.2914	39,936	23-May-2006	11:54	x86	SP2	SP2QFE
Pautoenr.dll	5.1.2600.2914	67,584	23-May-2006	11:54	x86	SP2	SP2QFE

MORE INFORMATION

This section describes the changes that have been made to the Credential Roaming service.

Credential roaming does not delete certificates that cannot be validated

Windows Vista includes support for credential roaming and for new cryptographic algorithms that are not supported in earlier versions of Windows. Because of this combination of features, a user may autoenroll for a certificate in Windows Vista and then the user may log on to an earlier version of Windows that cannot parse the certificate. In Windows Server 2003 SP1, credential roaming deletes a credential from the Active Directory directory service user store if the digital certificate cannot be validated.

This update prevents credential roaming from deleting the certificate from the Active Directory user store in Windows XP or in Windows Server 2003. If certificate validation fails during the autoenrollment process, credential roaming verifies that the certificate has not expired. If the certificate has expired, it is deleted from Active Directory together with the associated private key. If the certificate has not expired, no action is taken.

Credential roaming will ignore read-only domain controllers

A read-only domain controller (RODC) is a new feature that is planned for Microsoft Windows Server Code Name "Longhorn." A RODC can be deployed in a branch office environment where users may require authentication services but users are not expected to change objects that are stored in Active Directory.

Credential roaming requires that the user's credential store be synchronized with Active Directory during various user-initiated actions such as logon, lock workstation, and unlock workstation actions. Therefore, credential roaming will ignore RODCs. The Credential Roaming service will always look for a writeable domain controller, even if the service must to go across a wide area network (WAN) link.

Conflict resolution logic has been simplified

In Windows Server 2003 SP1, credential roaming offers several policies that enable the administrator to dictate what types of certificates and keys can roam with a particular user. These policies could introduce conflicts if a user imports the same certificate and the same private key on two different workstations and if the workstations have different settings for the certificate and for the private key. For example, a problem can occur if the certificate and the private key are exportable on one workstation and not on the other workstation. A problem may also occur if the certificate and the private key have strong private key protection on one workstation but not on the other workstation.

To resolve this issue, conflict resolution has been changed in this update so that the data in Active Directory is updated with what was last written to the object. For example, if two different workstations update the object in Active Directory, the second update overwrites the first update.

Windows XP SP2 and Windows Server 2003 SP1 support

A version of this update is available for Windows XP Service Pack 2 (SP2). If you install this update in Windows XP, users can use roaming certificates and roaming keys on multiple Windows XP SP2-based computers. If you expect users to use certificates and keys on Windows Server 2003 SP1-based computers and on Windows XP SP2-based computers, we strongly recommend that you also deploy this update on the Windows Server 2003 SP1-based computers. This step makes sure that the same credential roaming functionality is deployed enterprise-wide.

Note For information about how to configure and deploy credential roaming, visit the following Microsoft Web site: