Authentication Problems in Windows 2000 with NTLM 2 Levels Above 2 in a Windows NT 4.0 Domain

This article was previously published under Q305379
This article has been archived. It is offered "as is" and will no longer be updated.
If a Windows 2000-based domain with NTLM version 2 levels above 2 is trusted by a Windows NT 4.0-based domain, authentication problems may occur. When you log on to a Windows 2000-based computer (as a member of the Windows NT 4.0-based domain), you can access shares on the primary domain controller, but not on any other member server in the trusted Windows NT 4.0-based domain.

Also, a Windows 2000-based cluster that is running the higher level of NTLM 2 does not authenticate a joining node if both nodes are part of a Windows NT 4.0 Service Pack 6a-based domain. The node that attempts to join the cluster does not succeed and the following error is recorded in the cluster log:
[JOIN] Unable to get join version data from sponsor "ip address" using NTLM package, status 5.
The token that is returned by the Windows NT 4.0-based computer has a TokenSize value that is less than the Windows 2000 token if the NTLM 2 level is set above 2. This causes the TargetName and TargetInfo values to be null. Windows NT 4.0 has a function for a logon target that does not allow a null server name with high security, which causes the authentication problems.
A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.

To resolve this problem, contact Microsoft Product Support Services to obtain the hotfix. For a complete list of Microsoft Product Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

The English version of this fix should have the following file attributes or later:
   Date         Time   Version        Size    File name   -------------------------------------------------------   13-Sep-2001  19:30  4.0.1381.7097  188 KB  Netlogon.dll				

You must apply this file on the Windows NT 4.0 primary domain controller and backup domain controller.

NOTE: Because of file dependencies for Windows NT 4.0, this hotfix requires Windows NT 4.0 Service Pack 6a (SP6a) and the post-Windows NT 4.0 Service Pack 6a Security Rollup Package (SRP). For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
299444 Post-Windows NT 4.0 Service Pack 6a Security Rollup Package (SRP)
NOTE: Because of file dependencies for Windows 2000, this hotfix requires Microsoft Windows 2000 Service Pack 2 (SP2) and the hotfix that is described in the following Microsoft Knowledge Base article:
272129 Cluster Service Does Not Start on 'Joining' Node in Windows 2000 Cluster
To work around this problem, use a Windows 2000-based domain controller for the cluster nodes, or reduce the security for LmCompatibilityLevel to allow a join.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.
More information
For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:
296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot

Article ID: 305379 - Last Review: 10/26/2013 01:50:00 - Revision: 3.0

Microsoft Windows NT Server 4.0 Enterprise Edition

  • kbnosurvey kbarchive kbhotfixserver kbqfe kbbug kbfix kbwin2000presp3fix KB305379