MS16-101: Security update for Windows authentication methods: August 9, 2016

Notice
Important This article contains information that shows you how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, take any appropriate additional steps to help protect the computer.
Summary
This security update resolves multiple vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application on a domain-joined system.

To learn more about the vulnerability, see Microsoft Security Bulletin MS16-101.
More information
Important

  • All future security and non-security updates for Windows 8.1 and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you install update 2919355 on your Windows 8.1-based or Windows Server 2012 R2-based computer so that you receive future updates.
  • If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

Non-security-related fixes that are included in this security update

This security update also fixes the following non-security-related issues:

  • In a domain-joined Scale Out File Server (SoFS) on a domainless cluster, when an SMB client that is running either Windows 8.1 or Windows Server 2012 R2 connects to a node that is down, authentication fails. When this problem occurs, you may receive an error message that resembles the following message:

    STATUS_NO_TGT_REPLY
Additional information about this security update
The following articles contain additional information about this security update as it relates to individual product versions. The articles may contain known issue information.

  • 3177108 MS16-101: Description of the security update for Windows authentication methods: August 9, 2016
  • 3167679 MS16-101: Description of the security update for Windows authentication methods: August 9, 2016
  • 3192392 October 2016 security only quality update for Windows 8.1, and Windows Server 2012 R2
  • 3185331 October 2016 security monthly quality rollup for Windows 8.1, and Windows Server 2012 R2
  • 3192393 October 2016 security only quality update for Windows Server 2012
  • 3185332 October 2016 security monthly quality rollup for Windows Server 2012
  • 3192391 October 2016 security only quality update for Windows 7 SP1 and Windows Server 2008 R2 SP1
  • 3185330 October 2016 security monthly quality rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1
  • 3192440 Cumulative update for Windows 10: October 11, 2016
  • 3194798 Cumulative update for Windows 10 Version 1607 and Windows Server 2016: October 11, 2016
  • 3192441 Cumulative update for Windows 10 Version 1511: October 11, 2016

Security updates that are replaced

The following security updates have been replaced:
  • 3176492 Cumulative update for Windows 10: August 9, 2016
  • 3176493 Cumulative update for Windows 10 Version 1511: August 9, 2016
  • 3176495 Cumulative update for Windows 10 Version 1607: August 9, 2016
The following are the new security updates that replace the security updates mentioned earlier:
  • 3192440 Cumulative update for Windows 10: October 11, 2016
  • 3194798 Cumulative update for Windows 10 Version 1607 and Windows Server 2016: October 11, 2016
  • 3192441 Cumulative update for Windows 10 Version 1511: October 11, 2016

Known issues in this security update

  • Known issue 1

    The security updates that are provided in MS16-101 and newer updates disable the ability of the Negotiate process to fall back to NTLM when Kerberos authentication fails for password change operations with the STATUS_NO_LOGON_SERVERS (0xc000005e) error code. In this situation, you may receive one of the following error codes.

    HexadecimalDecimalSymbolicFriendly
    0xc00003881073740920STATUS_DOWNGRADE_DETECTEDThe system detected a possible attempt to compromise security. Please make sure that you can contact the server that authenticated you.
    0x4f11265ERROR_DOWNGRADE_DETECTEDThe system detected a possible attempt to compromise security. Please make sure that you can contact the server that authenticated you.


    Workaround

    If password changes that previously succeeded fail after the installation of MS16-101, it's likely that password changes were previously relying on NTLM fallback because Kerberos was failing. In order to change passwords successfully by using Kerberos protocols, follow these steps:

    1. Configure open communication on TCP port 464 between clients that have MS16-101 installed and the domain controller that is servicing password resets.

      Read-only domain controllers (RODCs) can service self-service password resets if the user is allowed by the RODCs password replication policy. Users who are not allowed by the RODC password policy require network connectivity to a read/write domain controller (RWDC) in the user account domain.

      Note To check whether TCP port 464 is open, follow these steps:

      1. Create an equivalent display filter for your network monitor parser. For example:
        ipv4.address== <ip address of client> && tcp.port==464
      2. In the results, look for the "TCP:[SynReTransmit" frame.

        Frame
    2. Make sure that the target Kerberos names are valid. (IP addresses are not valid for the Kerberos protocol. Kerberos supports short names and fully qualified domain names.)
    3. Make sure that service principal names (SPNs) are registered correctly.

      For more information, see Kerberos and Self-Service Password Reset.
  • Known issue 2

    We know about an issue in which programmatic password resets of domain user accounts fail and return the STATUS_DOWNGRADE_DETECTED (0x800704F1) error code if the expected failure is one of the following:

    • ERROR_INVALID_PASSWORD
    • ERROR_PWD_TOO_SHORT (rarely returned)
    • STATUS_WRONG_PASSWORD
    • STATUS_PASSWORD_RESTRICTION

    The following table shows the full error mapping.

    HexadecimalDecimalSymbolicFriendly
    0x5686ERROR_INVALID_PASSWORDThe specified network password is not correct.
    0x267615ERROR_PWD_TOO_SHORTThe password that was provided is too short to meet the policy of your user account. Please provide a longer password.
    0xc000006a-1073741718STATUS_WRONG_PASSWORDWhen you try to update a password, this return status indicates that the value that was provided as the current password is incorrect.
    0xc000006c-1073741716STATUS_PASSWORD_RESTRICTIONWhen you try to update a password, this return status indicates that some password update rule was violated. For example, the password may not meet the length criteria.
    0x800704F11265STATUS_DOWNGRADE_DETECTEDThe system cannot contact a domain controller to service the authentication request. Please try again later.
    0xc0000388-1073740920STATUS_DOWNGRADE_DETECTEDThe system cannot contact a domain controller to service the authentication request. Please try again later.


    Resolution

    MS16-101 has been re-released to address this issue. Install the latest version of the updates for this bulletin to resolve this issue.

  • Known issue 3

    We know about an issue in which programmatic resets of local user account password changes may fail and return the STATUS_DOWNGRADE_DETECTED (0x800704F1) error code.

    The following table shows the full error mapping.

    HexadecimalDecimalSymbolicFriendly
    0x4f11265ERROR_DOWNGRADE_DETECTEDThe system cannot contact a domain controller to service the authentication request. Please try again later.


    Resolution

    MS16-101 has been re-released to address this issue. Install the latest version of the updates for this bulletin to resolve this issue.

  • Known issue 4

    Passwords for disabled and locked-out user accounts cannot be changed using the negotiate package.

    Password changes for disabled and locked-out accounts will still work when using other methods such as when using an LDAP modify operation directly. For example, the PowerShell cmdlet Set-ADAccountPassword uses an "LDAP Modify" operation to change the password and remains unaffected.

    Workaround

    These accounts require an administrator to make password resets. This behavior is by design after you install MS16-101 and later fixes.

  • Known issue 5

    Applications that use the NetUserChangePassword API and that pass a servername in the domainname parameter will no longer work after MS16-101 and later updates are installed.

    Microsoft documentation states that providing a remote server name in the domainname parameter of the NetUserChangePassword function is supported. For example, the NetUserChangePassword function MSDN topic states the following:

    domainname [in]
    A pointer to a constant string that specifies the DNS or NetBIOS name of a remote server or domain on which the function is to execute. If this parameter is NULL, the logon domain of the caller is used.
    Status

    This guidance has been superseded by MS16-101, unless the password reset is for a local account on the local computer.

    Post MS16-101, in order for domain user password changes to work, you must pass a valid DNS Domain Name to the NetUserChangePassword API.
  • Known issue 6

    After you install the security updates that are described in MS16-101, remote, programmatic changes of a local user account password, and password changes across untrusted forest fail.

    This operation fails because the operation relies on NTLM fall-back which is no longer supported for nonlocal accounts after MS16-101 is installed.

    A registry entry is provided that you can use to disable this change.

    Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.

    ImportantThis section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
    322756How to back up and restore the registry in Windows


    To disable this change, set the NegoAllowNtlmPwdChangeFallback DWORD entry to use a value of 1 (one).

    Important Setting the NegoAllowNtlmPwdChangeFallback registry entry to a value of 1 will disable this security fix:
    Registry valueDescription
    0 Default value. Fallback is prevented.
    1Fallback is always allowed. The security fix is turned off. Customers that are having issues with remote local accounts or untrusted forest scenarios can set the registry to this value.
    To add these registry values, follow these steps:
    1. Click Start, click Run, type regedit in the Open box, and then click OK.
    2. Locate and then click the following subkey in the registry:
      HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa
    3. On the Edit menu, point to New, and then click DWORD Value.
    4. Type NegoAllowNtlmPwdChangeFallback for the name of the DWORD, and then press ENTER.
    5. Right-click NegoAllowNtlmPwdChangeFallback, and then click Modify.
    6. In the Value data box, type 1 to disable this change, and then click OK.

      Note To restore the default value, type 0 (zero), and then click OK.
    Status

    The root cause of this issue is understood. This article will be updated with additional details as they become available.
How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, seeGet security updates automatically.

Method 2: Microsoft Update Catalog

To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Method 3: Microsoft Download Center

You can obtain the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

Click the download link in Microsoft Security Bulletin MS16-101 that corresponds to the version of Windows that you are running.
More information

Security update deployment information

Windows Vista (all editions)

Reference Table

The following table contains the security update information for this software.

Security update file namesFor all supported 32-bit editions of Windows Vista:
Windows6.0-KB3167679-x86.msu
For all supported x64-based editions of Windows Vista:
Windows6.0-KB3167679-x64.msu
Installation switchesSee Microsoft Knowledge Base article 934307
Restart requirementYou must restart the system after you apply this security update.
Removal informationWUSA.exe does not support uninstalling updates. To uninstall an update that is installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.
File informationSee Microsoft Knowledge Base article 3167679
Registry key verificationNote This update does not add a registry key to validate its presence.


Windows Server 2008 (all editions)

Reference Table

The following table contains the security update information for this software.

Security update file namesFor all supported 32-bit editions of Windows Server 2008:
Windows6.0-KB3167679-x86.msu
For all supported x64-based editions of Windows Server 2008:
Windows6.0-KB3167679-x64.msu
For all supported Itanium-based editions of Windows Server 2008:
Windows6.0-KB3167679-ia64.msu
Installation switchesSee Microsoft Knowledge Base article 934307
Restart requirementYou must restart the system after you apply this security update.
Removal informationWUSA.exe does not support uninstalling updates. To uninstall an update that is installed by WUSA, click Control Panel, and then click Security. Under Windows Update, click View installed updates, and then select from the list of updates.
File informationSee Microsoft Knowledge Base article 3167679


Windows 7 (all editions)

Reference Table

The following table contains the security update information for this software.
Security update file nameFor all supported 32-bit editions of Windows 7:
Windows6.1-KB3192391-x86.msu
Security Only
For all supported 32-bit editions of Windows 7

Windows6.1-KB3185330-x86.msu
Monthly Rollup
For all supported x64-based editions of Windows 7:
Windows6.1-KB3192391-x64.msu
Security Only
For all supported x64-based editions of Windows 7:
Windows6.1-KB3185330-x64.msu
Monthly Rollup
Installation switchesSee Microsoft Knowledge Base Article 934307
Restart requirementYou must restart the system after you apply this security update.
Removal informationTo uninstall an update that is installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security. Under Windows Update, click View installed updates, and then select from the list of updates.
File informationSee Microsoft Knowledge Base Article 3192391
See Microsoft Knowledge Base Article 3185330
Registry key verificationNote This update does not add a registry key to validate its installation.


Windows Server 2008 R2 (all editions)

Reference Table

The following table contains the security update information for this software.
Security update file nameFor all supported x64-based editions of Windows Server 2008 R2:
Windows6.1-KB3192391-x64.msu
Security Only
For all supported x64-based editions of Windows Server 2008 R2:
Windows6.1-KB3185330-x64.msu
Monthly Rollup
For all supported Itanium-based editions of Windows Server 2008 R2:
Windows6.1-KB3192391-ia64.msu
Security Only
For all supported Itanium-based editions of Windows Server 2008 R2:
Windows6.1-KB3185330-ia64.msu
Monthly Rollup
Installation switchesSee Microsoft Knowledge Base Article 934307
Restart requirementA system restart is required after you apply this security update.
Removal informationTo uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, and then under Windows Update, click View installed updates and select from the list of updates.
File informationSee Microsoft Knowledge Base Article 3192391
See Microsoft Knowledge Base Article 3185330
Registry key verificationNote A registry key does not exist to validate the presence of this update.


Windows 8.1 (all editions)

Reference Table

The following table contains the security update information for this software.
Security update file nameFor all supported 32-bit editions of Windows 8.1:
Windows8.1-KB3192392-x86.msu
Security Only
For all supported 32-bit editions of Windows 8.1:
Windows8.1-KB3185331-x86.msu
Monthly Rollup
For all supported x64-based editions of Windows 8.1:
Windows8.1-KB3192392-x64.msu
Security Only
For all supported x64-based editions of Windows 8.1:
Windows8.1-KB3185331-x64.msu
Monthly Rollup
Installation switchesSee Microsoft Knowledge Base Article 934307
Restart requirementYou must restart the system after you apply this security update.
Removal informationTo uninstall an update that is installed by WUSA, use the /Uninstall setup switch or Click Control Panel, click System and Security, and then click Windows Update. Under See also, click Installed updates, and then select from the list of updates.
File informationSee Microsoft Knowledge Base Article 3192392
See Microsoft Knowledge Base Article 3185331
Registry key verificationNote This update does not add a registry key to validate its installation.


Windows Server 2012 and Windows Server 2012 R2 (all editions)

Reference Table

The following table contains the security update information for this software.
Security update file nameFor all supported editions of Windows Server 2012:
Windows8-RT-KB3192393-x64.msu
Security Only
For all supported editions of Windows Server 2012:
Windows8-RT-KB3185332-x64.msu
Monthly Rollup
For all supported editions of Windows Server 2012 R2:
Windows8.1-KB3192392-x64.msu
Security Only
For all supported editions of Windows Server 2012 R2:
Windows8.1-KB3185331-x64.msu
Monthly Rollup
Installation switchesSee Microsoft Knowledge Base Article 934307
Restart requirementA system restart is required after you apply this security update.
Removal informationTo uninstall an update installed by WUSA, use the /Uninstall setup switch or click Control Panel, click System and Security, click Windows Update, and then under See also, click Installed updates and select from the list of updates.
File informationSee Microsoft Knowledge Base Article 3192393
See Microsoft Knowledge Base Article 3185332
Registry key verificationNote A registry key does not exist to validate the presence of this update.


Windows 10 (all editions)

Reference Table

The following table contains the security update information for this software.
Security update file nameFor all supported 32-bit editions of Windows 10:
Windows10.0-KB3192440-x86.msu
For all supported x64-based editions of Windows 10:
Windows10.0-KB3192440-x64.msu
For all supported 32-bit editions of Windows 10 Version 1511:
Windows10.0-Kb3192441-x86.msu
For all supported x64-based editions of Windows 10 Version 1511:
Windows10.0-Kb3192441-x64.msu
For all supported 32-bit editions of Windows 10 Version 1607:
Windows10.0-KB3194798-x86.msu
For all supported x64-based editions of Windows 10 Version 1607:
Windows10.0-KB3194798-x64.msu
Installation switchesSee Microsoft Knowledge Base Article 934307
Restart requirementYou must restart the system after you apply this security update.
Removal informationTo uninstall an update that is installed by WUSA, use the /Uninstall setup switch or Click Control Panel, click System and Security, and then click Windows Update. Under See also, click Installed updates, and then select from the list of updates.
File informationSee Microsoft Knowledge Base Article 3192440
See Microsoft Knowledge Base Article 3192441
See Microsoft Knowledge Base Article 3194798
Registry key verificationNote This update does not add a registry key to validate its installation.

How to obtain help and support for this security update

Help for installing updates: Support for Microsoft Update

Security solutions for IT professionals: TechNet Security Troubleshooting and Support

Help for protecting your Windows-based computer from viruses and malware: Virus Solution and Security Center

Local support according to your country: International Support
malicious attacker exploit
Properties

Article ID: 3178465 - Last Review: 10/14/2016 18:08:00 - Revision: 6.0

Windows 10, Windows 10 Version 1511, Windows 10 Version 1607, Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Standard, Windows Server 2012 R2 Essentials, Windows Server 2012 R2 Foundation, Windows 8.1 Enterprise, Windows 8.1 Pro, Windows 8.1, Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows Server 2012 Essentials, Windows Server 2012 Foundation, Windows Server 2008 R2 Service Pack 1, Windows 7 Service Pack 1, Windows Server 2008 Service Pack 2, Windows Vista Service Pack 2

  • atdownload kbbug kbexpertiseinter kbfix kbsecbulletin kbsecurity kbsecvulnerability KB3178465
Feedback