Article ID: 904766 - View products that this article applies to.
Important This article contains information about how to modify the registry. Make sure to back up the registry before you modify it. Make sure that you know how to restore the registry if a problem occurs. For more information about how to back up, restore, and modify the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/256986/ )Description of the Microsoft Windows registry
This article contains information about how to modify the RequireAsChecksum registry entry. This registry entry helps provide additional protection after you install Microsoft security update 899587. This security update is documented in Security Bulletin MS05-042.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/899587/ )MS05-042: Vulnerabilities in Kerberos could allow denial of service, information disclosure, and spoofing
Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall your operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
Security update 899587 contains some security-related changes to functionality. Security Bulletin MS05-042 addresses the externally reported security vulnerabilities. However, in addition to the changes that are listed in each "Vulnerability Details" section of Security Bulletin MS05-042, security update 899587 includes another change in functionality. An optional, but recommended, registry entry (RequireAsChecksum) has been added to help provide additional protection for potential future PKINIT-related vulnerabilities. The RequireAsChecksum registry entry is located under the following registry subkeys:
Possible values for the RequireAsChecksum registry entry are as follows:
The smart card logon fails when all the following conditions are true:
Note You must restart a Windows 2000-based computer after you modify this registry entry. However, a restart is not required for computers that are running Windows XP or Windows Server 2003.
Article ID: 904766 - Last Review: October 11, 2007 - Revision: 1.3