Extended Protection for Authentication

Microsoft is announcing the availability of a new feature, Extended Protection for Authentication, on the Windows platform. This feature enhances the protection and handling of credentials when authenticating network connections by using Integrated Windows Authentication (IWA).

The update itself does not directly provide protection against specific attacks such as credential forwarding, but allows applications to opt in to Extended Protection for Authentication. This advisory briefs developers and system administrators on this new functionality and how it can be deployed to help protect authentication credentials.

The update in Microsoft Knowledge Base article 968389 modifies the SSPI in order to enhance the way Windows authentication works so that credentials are not easily forwarded when Integrated Windows Authentication (IWA) is enabled.

For more information, see security advisory 973811. To do this, visit the following Microsoft Web site:

For more information about known issues with this software, click the following article numbers to view the articles in the Microsoft Knowledge Base:

• 977073

  (http://support.microsoft.com/kb/977073/ )

  FIX: Digest authentication fails on a Windows Server 2003 member server when authenticating against a Windows Server 2008 R2 domain controller
• 979231

  (http://support.microsoft.com/kb/979231/ )

  Memory usage keeps increasing if Schannel authentication is used after the update 968389 is installed in Windows Vista or in Windows Server 2008

This security update modifies the SSPI in order to enhance the way Windows authentication works so that credentials are not easily forwarded when Integrated Windows Authentication (IWA) is enabled.

When Extended Protection for Authentication is enabled, authentication requests are bound to both the Service Principal Names (SPN) of the server the client tries to connect to and to the outer Transport Layer Security (TLS) channel over which the IWA authentication occurs. This is a base update that enables applications to opt in to the new feature.

After you install this security update, you must implement the following registry subkey settings to enable Extended Protection:

• Set the registry subkey value for
  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA\SuppressExtendedProtection
  to "0" (zero) to enable protection technology. By default, this registry subkey is not created when the security update is installed. If this registry subkey is not created, Extended Protection is disabled. When you set the SuppressExtendedProtection registry entry to "1" or when you delete this subkey, Extended Protection is disabled. When you set the SuppressExtendedProtection registry entry to "3" Extended Protection is disabled and channel bindings sent by Kerberos are also disabled, even if the application supplies them.
• Set the registry subkey value for
  HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\LmCompatibilityLevel
  to "3." This is not the default on Windows XP and Windows Server 2003. This is an existing key which enables NTLMv2 Authentication. Extended protection for Windows authentication only applies to NTLMv2, Kerberos, digest, and negotiation authentication protocols and does not apply to NTLMv1.

Note You must restart your computer after you set the SuppressExtendedProtection and the LmCompatibilityLevel registry values on a Windows XP-based computer.

After you install this security update, you must enable Extended Protection. To have us enable Extended Protection, go to the "Fix it for me" section. If you would rather turn on Automatic Updates yourself, go to the "Let me fix it myself" section.

Fix it for me

To enable Extended Protection automatically after you download and install the security update for your platform, click the Fix this problem link. Then click Run in the File Download dialog box, and follow the steps in this wizard.



Note This wizard may be in English only; however, the automatic fix also works for other language versions of Windows.

Note If you are not on the computer that has the problem, you can save the automatic fix to a flash drive or to a CD, and then you can run it on the computer that has the problem.

Let me fix it myself

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: To enable Extended Protection yourself after you download and install the security update for your platform, follow these steps:

1. Start Registry Editor. To do this, click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following registry subkey:
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
3. Verify that the registry values SuppressExtendedProtection and LmCompatibilityLevel are present.
   
   If the registry values are not present, follow these steps to create them:
   1. With the registry subkey that is listed in step 2 selected, on the Edit menu, point to New, and then click DWORD Value.
   2. Type SuppressExtendedProtection, and then press ENTER.
   3. With the registry subkey that is listed in step 2 selected, on the Edit menu, point to New, and then click DWORD Value.
   4. Type LmCompatibilityLevel, and then press ENTER.
4. Click to select the SuppressExtendedProtection registry value.
5. On the Edit menu, click Modify.
6. In the Value data box, type 0, and then click OK.
7. Click to select the LmCompatibilityLevel registry value.
8. On the Edit menu, click Modify.
   
   Note This step changes NTLM authentication requirements. Please review the following article in the Microsoft Knowledge Base to make sure that you are familiar with this behavior.
   239869

   (http://support.microsoft.com/kb/239869/ )

   How to enable NTLM 2 authentication
9. In the Value data box, type 3, and then click OK.
10. Exit Registry Editor.
11. If you make these changes on a Windows XP-based computer, you must restart the computer before the changes will take effect.

The following files are available for download from the Microsoft Download Center:
Download the Windows XP Service Pack 2 and Windows XP Service Pack 3 package now.

Download the Windows XP for x64-based Systems Service Pack 2 and Windows XP for x64-based Systems Service Pack 3 package now.

Download the Windows Server 2003 Service Pack 2 package now.

Download the Windows Server 2003 for x64-based Systems Service Pack 2 package now.

Download the Windows Server 2003 for Itanium-based Systems and Windows Server 2003 for Itanium-based Systems Service Pack 2 package now.

Download the Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 package now.

Download the Windows Vista for x64-based Systems, Windows Vista for x64-based Systems Service Pack 1, and Windows Vista for x64-based Systems Service Pack 2 package now.

Download the Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 package now.

Download the Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 package now.

Download the Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2 package now.

Release Date: August 7, 2009

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base: Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Windows XP and Windows Server 2003 file information

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the "SP requirement" and "Service branch" columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows Server 2003 and of Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SP n ), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.600 0 . 16 xxx	Windows Vista	RTM	GDR
  6.0.600 0 . 20 xxx	Windows Vista	RTM	LDR
  6.0.600 1 . 18 xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.600 1 . 22 xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into the original release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported IA-64-based versions of Windows Server 2008