network level authentication xp

Enabling Network Level Authentication on Windows XP Service Pack 3 for access to Server 2008 via Remote Desktop

"The remote computer requires Network Level Authentication, which your computer does not support."

To enable NLA on XP SP3, run regedit.exe:

1. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

2. Add tspkg to the Security Packages REG_MULTI_SZ

3. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders

4. Add credssp.dll to the SecurityProviders REG_SZ (separated by commas)

5. Reboot

happys days

OpenDSObject in Windows 7 "a local error has occurred"

Someone pinged me with a bug in a script on Windows 7 with a permissioned bind to AD over LDAP using the DN of a user. They received the error message: 0x8007203B error ("a local error has occurred").

From this:
Const ADS_SECURE_AUTHENTICATION = 1
Const ADS_USE_ENCRYPTION = 2
strPath = ldap://cn=machine,ou=Finance,dc=fabrikam,dc=com/
strUser = "cn=user,dc=fabrikam,dc=com"
strPassword = "4rTGh2#1"
Set objDSO = GetObject("LDAP:")
Set objThing = objDSO.OpenDSObject (strPath, strUser, strPassword, ADS_SECURE_AUTHENTICATION)

Apparently it worked under Windows XP...

The solution ... change strUser = "cn=user,dc=fabrikam,dc=com" to strUser = "fabrikam\user" or user@fabrikam.com Windows 7 does not like the user DN...

Create cached credentials without an interactive logon using runas or logonusera

Useful tidbit I used in a migration once upon a time…. you can create the cached credentials for a domain user by using runas.exe or coding with logonusera in some code then you’ll be able to logon interactively as that user from ctrl+alt+del without the domain being avaialble at logon. This works as long as the machine’s domain is not changed. Changing the domain can change the cert / hashing using to hash and store the credentials in the registry and also can force the OS to clear all cached credentials. I’ve found this useful when migrating users where the VPN solution is only available after logon and not at the logon screen. Obviously if you can see the domain at the logon screen then it doesn’t matter… also if you want to create an admin back door, for use when a user is roaming for remote debugging and support, using a domain account and not a local account you can send the code to create the cached credentials and not have to logon interactivel