ow to enable Windows 98/ME/NT clients to logon to Windows 2003 based Domains
View products that this article applies to.
Author: Yuval Sinay MVP
Community Solutions Content Disclaimer
Article ID : 555038
Last Review : May 4, 2005
Revision : 1.0
SYMPTOMS
Most companies have legacy operating system like - Windows 98, that give them backward compatibility for legacy applications.The default settings of Windows 2003 domains prohibit the logon of these clients, to overcome this limitation, a change of behavior is needed.
CAUSE
By default, security settings on domain controllers running Windows Server 2003 are configured to help prevent domain controller communications from being intercepted or tampered with by malicious users. For users to successfully negotiate communications with a domain controller that runs Windows Server 2003, these default security settings require that client computers use both server message block (SMB) signing and encryption or signing of secure channel traffic. Clients that run Windows NT 4.0 with SP2 or earlier installed and clients that run Windows 95 do not have SMB packet signing enabled and cannot authenticate to a Windows Server 2003 domain controller.
RESOLUTION
Clients Side:
Windows NT4
1. Install Windows NT4 Service Pack 6a.
2. Install Internet Explorer 6 with Service Pack 1 or higher.
3. Install DSCLIENT utility from Windows 2000 Server installation disk or from
http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/adextension.asp
Note: For additional information about Active Directory Client extensions for Windows 95, Windows 98, and Windows NT 4.0,
visit the following Microsoft Web site:
http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/adextension.asp
4. Enable NTLM 2 Authentication (please see "More Information" section for details).
5. Configure the workstation to use local WINS server.
6. Consider installing hotfix 275508:
SMB Session Credentials Are Not Updated After Password Change Resulting in Account Lockout
http://support.microsoft.com/kb/275508/
7. Configure the local DNS domain as DNS under TCP/IP properties.
Windows 98/ME
1. Install Internet Explorer 6 with Service Pack 1 or higher.
2. Install DSCLIENT utility from Windows 2000 Server installation disk or from
http://support.microsoft.com/default.aspx?scid=kb;en-us;288358
Note: Please review the knowlagebase: "Directory Services Client Update for Windows 98" 323455:
http://support.microsoft.com/default.aspx?scid=kb;en-us;323455
3. Enable NTLM 2 Authentication (please see "More Information" section for details).
4. Enable SMB Signing (please see "More Information" section for details).
5. Configure the workstation to use local WINS server.
6. Consider installing the hotfixes that descrive in:
Service Packs and Hotfixes That Are Available to Resolve Account Lockout Issues
http://support.microsoft.com/default.aspx?scid=kb;en-us;817701
7. Configure the local DNS domain as DNS under TCP/IP properties.
