Article ID: 304161
Article Last Modified on 1/31/2007
APPLIES TO
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Service Pack 2
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Advanced Server
- Microsoft Windows 2000 Service Pack 1
- Microsoft Windows 2000 Service Pack 2
This article was previously published under Q304161
SYMPTOMS
When you are using an Schannel SSPI package, ASC_RET_MUTUAL_AUTH is not set on return in the context attributes parameter. The AcceptSecurityContext API returns with ASC_RET_MUTUAL_AUTH not set, even though mutual authentication was achieved.
RESOLUTION
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to Obtain the Latest Windows 2000 Service Pack
The English version of this fix should have the following file attributes or later:
Date Time Version Size File name --------------------------------------------------------- 02-Jan-02 13:56 5.0.2195.4685 123,664 Adsldp.dll 02-Jan-02 13:56 5.0.2195.4762 130,320 Adsldpc.dll 02-Jan-02 13:56 5.0.2195.4016 62,736 Adsmsext.dll 02-Jan-02 13:56 5.0.2195.4797 356,112 Advapi32.dll 02-Jan-02 13:56 5.0.2195.4571 82,704 Cmnquery.dll 02-Jan-02 13:56 5.0.2195.4141 133,904 Dnsapi.dll 02-Jan-02 13:56 5.0.2195.4379 91,408 Dnsrslvr.dll 02-Jan-02 13:56 5.0.2195.4534 41,744 Dsfolder.dll 02-Jan-02 13:56 5.0.2195.4534 156,944 Dsquery.dll 02-Jan-02 13:56 5.0.2195.4574 110,352 Dsuiext.dll 03-Jan-02 17:26 5.0.2195.4685 521,488 Instlsa5.dll 03-Jan-02 17:27 5.1.2195.0 164,112 Instsch5.dll 02-Jan-02 13:56 5.0.2195.4630 145,680 Kdcsvc.dll 26-Nov-01 18:33 5.0.2195.4680 199,440 Kerberos.dll 03-Jan-02 17:22 5.0.2195.4797 708,880 Kernel32.dll 04-Sep-01 10:32 5.0.2195.4276 71,024 Ksecdd.sys 26-Nov-01 19:55 5.0.2195.4685 503,568 Lsasrv.dll 26-Nov-01 19:55 5.0.2195.4685 33,552 Lsass.exe 07-Dec-01 18:05 5.0.2195.4745 107,280 Msv1_0.dll 02-Jan-02 13:56 5.0.2195.4594 306,960 Netapi32.dll 02-Jan-02 13:56 5.0.2195.4686 359,184 Netlogon.dll 02-Jan-02 13:56 5.0.2195.4746 916,240 Ntdsa.dll 02-Jan-02 13:56 5.0.2195.4748 388,368 Samsrv.dll 02-Jan-02 13:56 5.0.2195.4583 128,784 Scecli.dll 02-Jan-02 13:56 5.0.2195.4600 299,792 Scesrv.dll 02-Jan-02 13:52 5.1.2195.0 146,192 Schannel.dll 30-May-01 02:03 5.0.2195.3649 3,584 Spmsg.dll 02-Jan-02 13:56 5.0.2195.4600 48,400 W32time.dll 06-Nov-01 13:43 5.0.2195.4600 56,592 W32tm.exe 02-Jan-02 13:56 5.0.2195.4769 125,712 Wldap32.dll
STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.
MORE INFORMATION
With MUTUAL_AUTH, the communicating parties must authenticate their identities to each other. The SSPI client requests for ISC_REQ_MUTUAL_AUTH in the InitializeSecurityContext API and the server requests for ASC_REQ_MUTUAL_AUTH in the AcceptSecurityContext API. On return, the SSPI client indicates that ISC_RET_MUTUAL_AUTH was achieved. But the server indicates that ISC_RET_MUTUAL_AUTH was not achieved, even though mutual authentication succeeded.
For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:
265173 Datacenter Program and Windows 2000 Datacenter Server Product
For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:
296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot
For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:
249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes
Additional query words:
Keywords: kbbug kbfix kbwin2000presp3fix kbqfe kbwin2000sp3fix kbenv kbsecurity kbui kbhotfixserver KB304161