Article ID: 129457
Article Last Modified on 11/1/2006
APPLIES TO
- Microsoft Windows NT Server 4.0, Terminal Server Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT 4.0 Service Pack 3
This article was previously published under Q129457
SYMPTOMS
Windows NT 4.0 with Service Pack 3 (SP3) installed provides the capability to restrict anonymous users from obtaining system information. For more information, please see the following article in the Microsoft Knowledge Base:
143474: Restricting Information Available to Anonymous Logon Users
However, with RestrictAnonymous access enabled, anonymous connections are able to obtain the password policy from a Windows NT Server. The password policy defines the Windows NT domain policy with respect to the minimum password length, whether blank passwords are permitted, maximum password age, and password history.
Anonymous access to the password policy information is used by Windows NT to provide end-users detailed error information under specific circumstances. If the user is required to change their password at the next logon, and the user enters a new password that is rejected because of the password policy, Windows NT can tell the user why the password was rejected. The password policy is obtained by the system before the user has completed the logon and therefore uses an anonymous connection.
For example, assume there is a password policy that requires a minimum password length of 8 characters and a history that remembers the last 5 passwords. If the user chooses a new password of 6 characters, or enters a previous password, they see a detailed error message with the following information:
RESOLUTION
Microsoft has a fix available that disables anonymous access to password policy information when the RestrictAnonymous access is enabled. When the hotfix is applied and RestrictAnonymous is enabled, anonymous connections cannot obtain password policy information.
Microsoft recommends installing the hotfix on all domain controllers that have Service Pack 3 installed.
To resolve this problem, obtain the latest service pack for Windows NT 4.0 or Windows NT Server 4.0, Terminal Server Edition. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack
STATUS
Microsoft has confirmed that this is a problem in Windows NT 4.0 and Windows NT Server 4.0, Terminal Server Edition. This problem was first corrected in Windows NT 4.0 Service Pack 4.0 and Windows NT Server 4.0, Terminal Server Edition Service Pack 4.
MORE INFORMATION
If the user performs the same steps outlined in the example above after the hotfix is installed, they receive the following error message:
Your new password does not meet the minimum length or password history requirements of the domain.
The user should consult the account administrator to determine the password policy in effect for their account domain.
Additional query words: 4.00 sp3
Keywords: kbhotfixserver kbqfe kbbug kbenv kbfix KB129457
