Connecting Win98 Work Stations to Win2k3

The main article is Knowledge Base #555038
http://support.microsoft.com/kb/555038

For '98, the relavant section is:

1. Install Internet Explorer 6 with Service Pack 1 or higher.
http://www.microsoft.com/windows/ie/ie6/downloads/critical/ie6sp1/default.mspx

2. Install DSCLIENT utility from Windows 2000 Server installation disk or from
http://support.microsoft.com/default.aspx?scid=kb;en-us;288358

Installing the .msi file they link to does NOT install the required files; it installs the file that installs the files. You must run C:\Program Files\Microsoft\DSClient9xSetup\dsclient.exe to actually install the files.

Note: Please review the knowlagebase: "Directory Services Client Update for Windows 98" 323455:
http://support.microsoft.com/default.aspx?scid=kb;en-us;323455

3. Enable NTLM 2 Authentication
http://support.microsoft.com/default.aspx?scid=http://support.microsoft.com:80/support/kb/articles/Q239/8/69.ASP&NoWebContent=1

To verify your installation version:

1. Right click start, then click Explorer. in the left panel, select the %SystemRoot%\System folder (press the left arrow twice, quickly type "system")
2. In the right panel (press tab), locate the Secur32.dll file.
3. Right-click the file, and then click Properties. (Alt-F, r)
4. Click the Version tab. (tab, right arrow)

The description for the 56-bit version is "Microsoft Win32 Security Services (Export Version)." The description for the 128-bit version is "Microsoft Win32 Security Services (US and Canada Only)."

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\LMCompatibility DWORD:1 (M$ and ^ says to use 3 but 1 seems a better setting: "Level 1 - Use NTLM 2 session security if negotiated. Clients use LM and NTLM authentication, and use NTLM 2 session security if the server supports it")

4. Enable SMB Signing
http://support.microsoft.com/default.aspx?scid=kb;en-us;887429

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP\EnableSecuritySignature DWORD:1

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\VxD\VNETSUP\RequireSecuritySignature DWORD:0

5. Configure the workstation to use local WINS server.

6. Consider installing the hotfixes that are described in: Service Packs and Hotfixes That Are Available to Resolve Account Lockout Issues
http://support.microsoft.com/default.aspx?scid=kb;en-us;817701

7. Configure the local DNS domain as DNS under TCP/IP properties.

Note: If the logon problem is'nt resolved, please review the following knowlagebase: "Problems logging on to a Windows 2000-based server or a Windows 2003-based server"
http://support.microsoft.com/default.aspx?kbid=272594

See also:

• http://blackflag.wordpress.com/2006/01/24/the-vulnerability-of-windows-passwords-to-table-based-cracking/