[jds]

Background : I'm investigating connectivity problems of W98SE on a Server 2008 based LAN. Since the IT department is antagonistic to W98SE, any configuration changes (at the server) to help W98SE are basically not an option.

From some material I've read, the problem may be that 128 bit encryption for NTLMv2 may be required by default on a Server 2008 LAN..

http://support.microsoft.com/kb/239869 says :

Quote

By default, NTLM 2 session security encryption is restricted to a maximum key length of 56 bits. Optional support for 128-bit keys is automatically installed if the system satisfies United States export regulations. To enable 128-bit NTLM 2 session security support, you must install Microsoft Internet Explorer 4.x or 5 and upgrade to 128-bit secure connection support before you install the Active Directory Client Extension.

To verify your installation version:

1. Use Windows Explorer to locate the Secur32.dll file in the %SystemRoot%\System folder.
2. Right-click the file, and then click Properties.
3. Click the Version tab. The description for the 56-bit version is "Microsoft Win32 Security Services (Export Version)." The description for the 128-bit version is "Microsoft Win32 Security Services (US and Canada Only)."

Now, I have Internet Explorer 5.01 SP2;Q313829 (5.00.3314.2101) installed, and it says it's 128 bit, yet my SECUR32.DLL file says "Microsoft Win32 Security Services (Export Version)", so that's apparently 56 bit.

I've tried installing 'dsclient9x.msi' (Active Directory Client Extension) which installs 'SECUR32.DLL' version 4.10.2226, also '266772USA8.EXE' which installs SECUR32.DLL version 4.10.2228. Despite the latter having "USA" in it's title, still the version string for 'SECUR32.DLL' is indicating "(Export Version)".

All these steps individually and/or together are supposed to result in the 128 bit version of 'SECUR32.DL'. So, does the 128 bit version described in the above (and other) KB actually exist???

BTW, same exercise with a W98SE PC with IE6SP1, produced the same result.

Also BTW, versions 5.5 and newer of IE are supposed to come with 128 bit encryption as standard, older versions (down to v4, if I recall) can be upgraded to 128 bit, as with the above 5.01SP2.

Joe.

[jaclaz]

I seem to remember that it is DUN reinstalling needed.

Mdgx's site down?

http://webcache.goog...t&ct=clnk&gl=it

Quote

Microsoft Windows 98 SE Dial-Up Networking (DUN) Upgrade v1.4 adds 128-bit PPTP encryption:
Direct download [459 KB, English].
If already installed Active Directory Services (ADS) Client for Windows 9x/ME [2.95 MB], you MUST uninstall it BEFORE installing DUN Upgrade 1.4! Reinstall ADS Client AFTER that.
More info.
ADS Client info.
ADS Client installs NEWer versions of MSNET32.DLL, MSNP32.DLL, SECUR32.DLL, DFS.VXD, VNETSUP.VXD + VREDIR.VXD!

Links:
KB:
http://web.archive.o....com/?id=285189

Direct download:
http://www.am.net/li...se/dun14-SE.exe

jaclaz

[jds]

jaclaz, on 12 November 2010 - 01:26 PM, said:

I seem to remember that it is DUN reinstalling needed.

Mdgx's site down?
jaclaz

Ahhh, I forgot to mention, I've tried installing DUN 1.4 too (I've tried lots of things over the past few days, I'm losing my mind;-)! BTW, there's a KB that says you must uninstall DSCLIENT before installing DUN, after which you can then reinstall DSCLIENT. Unfortunately, that also didn't help (if I recall, DUN didn't do anything to SECUR32.DLL).

At this point, I'm wondering if the SECUR32.DLL version as described in the KB's (eg.kb239869) actually exists?!

BTW, on the other matter of MDGx's site, it says "This site has been suspended". I hope that's a temporary problem! It was OK 24 hours ago.

Joe.

This post has been edited by jds: 12 November 2010 - 09:46 PM

[erpdude8]

jds, on 12 November 2010 - 12:07 PM, said:

Also BTW, versions 5.5 and newer of IE are supposed to come with 128 bit encryption as standard, older versions (down to v4, if I recall) can be upgraded to 128 bit, as with the above 5.01SP2.

that's because the 128-bit versions of IE 5.01 SP, IE 5.5 and IE 6.0 install 128-bit versions of the RSAENH.DLL & SCHANNEL.DLL files and NOT the 128-bit version of the SECUR32.DLL file. Installing/upgrading to the 128bit encryption edition of IE does not upgrade the SECUR32.DLL file to 128-bit version.

I don't think there is a secur32.dll file for Win9x that has 128-bit encryption. It's more likely that it's a myth to me. The stuff from Microsoft KB article 239869 is somewhat convoluted and not entirely accurate. If a 128-bit version of secur32.dll does exist, it's probably for NT-based OSes only.

if dsclient for win9x doesn't install the correct version of the secur32.dll file, you may want to read the following Annoyances.org thread:
http://www.annoyance...003/t1128901046

This post has been edited by erpdude8: 13 November 2010 - 04:33 AM

[triger49]

Hi

Try this...it applies to Server 2003 and they changed some things but
if memory serves it is the Dsclient software you need....been awhile
since I dealt with this...

http://support.micro...kb;en-us;555038

HTH

Jake

Edit; scratch this idea...it's the old version....I was told Microsoft updated it.....grrgh

This post has been edited by triger49: 13 November 2010 - 07:44 AM

[jaclaz]

Both the 4.10.2226 contained in:
http://download.micr.../dsclient9x.msi
and the newer 4.10.2228 version contained in:
ftp://ftp.catalyst.c...rt/dsclient.exe

appear like being the "export" version.

I have seen a few references to IE 6 connected with the encryption, maybe there is an updated "non-export" version of SECUR32.DLL in it's install?

Or maybe the trick is in "money"?:
http://articles.tech...11-5035024.html

Quote

Updated Windows 9x Dsclient available
Since the Active Directory client extension’s initial release, Microsoft has discovered a few minor bugs and released an update in the form of a hot fix. You can obtain this update by contacting Microsoft’s Product Support Services by phone. Although a support call to Microsoft usually costs around $200, if you ask the service representative specifically for the update and not technical assistance, he or she will usually waive the charges. Click here for a list of Microsoft Product Support Services phone numbers and rates or here for more information about acquiring the updated Windows 9x Dsclient.

OT, but not much, and JFYI:
http://support.microsoft.com/dllhelp

Mdgx site is back online.

jaclaz

P.S.: What about this one?:
http://www.microsoft...&displaylang=en

Quote

Brief Description

This download includes extensions for the Windows® 95, Windows 98, and Windows NT® 4.0 operating systems that allow those client platforms to take advantage of features provided by the Windows 2000 Active Directory service.

It contains a Windows 2000 version of SECUR32.DLL.

From the .chm inside the download:

Quote

Searching for printers in Active Directory

You can locate shared printers in Active Directory from computers running Windows 95, Windows 98, or Windows NT 4.0. To do so, you must install the following software on those computers:

Active Directory client
Microsoft Internet Explorer version 4.01 or later
Service Pack 6a (for computers running Windows NT 4.0)

This post has been edited by jaclaz: 13 November 2010 - 09:54 AM

[triger49]

hi;

Not in the ie6sp1 install, but here is what is "suppose" to be
the none export version 4.10.2228.....

Instant Messaging Client Authentication From Separate Domain

http://support.micro...com/kb/q267972/

HTH

Jake

[jaclaz]

Only for the record, here is the stupid unavailable update page:
http://web.archive.o...om/?kbid=323466

@triger49
Seemingly the file at:
http://support.micro...com/kb/q267972/
http://download.micr.../266772usa8.exe
contains two different versions of the "Export" version also, renamed as secur32.98g and secur32.98s

jaclaz

[triger49]

jaclaz, on 13 November 2010 - 10:04 AM, said:

@triger49
Seemingly the file at:
http://support.micro...com/kb/q267972/
http://download.micr.../266772usa8.exe
contains two different versions of the "Export" version also, renamed as secur32.98g and secur32.98s

jaclaz

Hi Jaclaz;

I saw that, which is why I put in quotes "suppose" to be. I marvel that
a DLL as widely used as this one appears to be is so tough to track
down concrete information on.

Jake

[dencorso]

Quote

contains two different versions of the "Export" version also, renamed as secur32.98g and secur32.98s

98g is for the "Gold" edition = Win 98 FE, while 98s is for Win 98 SE.
I've just checked and redownloaded the dsclient.exe, and also Q266772, Q267879 and Q267972... these latter 3 documents lead one to the same 267972USA8.EXE hotfix, containing the same Export Version of secur32.dll, v, 2228, which is also contained in the dsclient. So that leads nowhere. For the what it's worth, if the 128-bit exists, it ought to be marked "US and Canada Only", not "Non-Export" or whatever. By now, i think erpdude8 is right: the 128-bit version is a myth (moreover, if it weren't, probably Gape would have got a copy of it and included it in the uSP, and that never happened).
@triger49: in what regards Win 9x/ME files, curb your marvel, because, by now, almost anything already is tough to track, and it'll get worse...

[jaclaz]

dencorso, on 13 November 2010 - 11:56 AM, said:

I've just checked and redownloaded the dsclient.exe, and also Q266772, Q267879 and Q267972... these latter 3 documents lead one to the same 267972USA8.EXE hotfix, containing the same Export Version of secur32.dll, v, 2228, which is also contained in the dsclient. So that leads nowhere.

You mean you didn't trust my word for it?



Current question is: would the "other" download and the 2K .dll work on windows 9x?

jaclaz

[PROBLEMCHYLD]

Nevermind erpdude8 already posted.

This post has been edited by PROBLEMCHYLD: 13 November 2010 - 12:52 PM

[triger49]

dencorso, on 13 November 2010 - 11:56 AM, said:

@triger49: in what regards Win 9x/ME files, curb your marvel, because, by now, almost anything already is tough to track, and it'll get worse...

LOL, aren't you just a ray of sunshine.....seriously tho, look at the big picture.
Right here on msfn, we have MDGX running a virtual Windows National Archive
We have Jaclaz who will earn a place on Wikipedia for his Bookmarks library.
Yourself, you have probably forgotten more than most of us will know about 9x.
Xeno, Tihiy, Rloew literaly reinventing the wheel and showing us what MS$ could
have done. The List goes on and on, erpdude, LLXX, Gape, Maximus-Decim.
The point is, as a rule of thumb somebody around here has "been there, done that"
How this silly little DLL slipped under everybody's radar just amazed me.

Jake

[dencorso]

True enough, Jake! Of course.

[herbalist]

I'm not sure if this is any help or if it confuses the situation even more. On my old 98FE unit, my copy of secur32.dll does not say export version or USA and Canada on the version tab. Just says Microsoft Win32 Security Services.
The MD5 for the file is 677273be08256ea12afdfc8da91ac54a if it's of any help. So far, I'm unable to determine just where I got this file. It does have DUN1.4 installed.

Rick

This post has been edited by herbalist: 13 November 2010 - 02:39 PM

[jaclaz]

herbalist, on 13 November 2010 - 02:16 PM, said:

The MD5 for the file is 677273be08256ea12afdfc8da91ac54a if it's of any help. So far, I'm unable to determine just where I got this file.

What filesize, what version?

jaclaz

[herbalist]

It appears to be an OEM file. I missed it in the file listing.

[PROBLEMCHYLD]

Quote

How to get 128-bit secur32.dll file...
In tinkering with a factory-state Dell with Win98 SE, I've discovered that having IE6 with 128bit (only that app upgraded after factory-state) somehow isn't what the dsclient9x.msi wants when deciding which version of secur32.dll to give you (56bit or 128). With IE6 you'll get 56. However, when I went back to true factory state and then installed the "high encryption pack" version of IE, version 5 for Win98, followed by execution of dsclient9x.msi, I then ended up with the 128-bit version of secur32.dll. Be cautious, however, since I've found Microsoft documentation on the Web that indicates that subsequent hot fixes can destroy what dsclient9x.msi sets up. Sorry to not include links. I don't have them handy but this information should be easy to find with simple searches on key words/phrases within this text.

[jds]

erpdude8, on 13 November 2010 - 04:25 AM, said:

that's because the 128-bit versions of IE 5.01 SP, IE 5.5 and IE 6.0 install 128-bit versions of the RSAENH.DLL & SCHANNEL.DLL files and NOT the 128-bit version of the SECUR32.DLL file. Installing/upgrading to the 128bit encryption edition of IE does not upgrade the SECUR32.DLL file to 128-bit version.

Thanks for that info. It explains why IE can have 128 bit encryption despite SECUR32.DLL.

erpdude8, on 13 November 2010 - 04:25 AM, said:

if dsclient for win9x doesn't install the correct version of the secur32.dll file, you may want to read the following Annoyances.org thread:
http://www.annoyance...003/t1128901046

Yeah! That's pretty similar to what I'm facing now. Pity there was no resolution.

herbalist, on 13 November 2010 - 02:16 PM, said:

I'm not sure if this is any help or if it confuses the situation even more. On my old 98FE unit, my copy of secur32.dll does not say export version or USA and Canada on the version tab. Just says Microsoft Win32 Security Services.
The MD5 for the file is 677273be08256ea12afdfc8da91ac54a if it's of any help. So far, I'm unable to determine just where I got this file. It does have DUN1.4 installed.

That's right, older versions of SECUR32.DLL do no differentiate Export vs US/Canada sub-versions. I think that's because this was before the 128 bit encryption for NTLMv2 was added. So only newer versions have that split.

PROBLEMCHYLD, on 13 November 2010 - 05:01 PM, said:

Quote

How to get 128-bit secur32.dll file...
In tinkering with a factory-state Dell with Win98 SE, I've discovered that having IE6 with 128bit (only that app upgraded after factory-state) somehow isn't what the dsclient9x.msi wants when deciding which version of secur32.dll to give you (56bit or 128). With IE6 you'll get 56. However, when I went back to true factory state and then installed the "high encryption pack" version of IE, version 5 for Win98, followed by execution of dsclient9x.msi, I then ended up with the 128-bit version of secur32.dll. Be cautious, however, since I've found Microsoft documentation on the Web that indicates that subsequent hot fixes can destroy what dsclient9x.msi sets up. Sorry to not include links. I don't have them handy but this information should be easy to find with simple searches on key words/phrases within this text.

Yes, I encountered this too, which is the reason why I've tried this on W98 machines with both IE6 and IE5, as it is implied that the DSClient install incorrectly determines the encryption capabilities of IE6. However, I didn't get any different result in either case.

----------------------------

The KB's suggest that the DSClient installer package checks the security capability (56 vs 128 bit encryption) of your IE installation, to decide if you qualify for the 56 bit (Export) or 128 bit (US/Canada) capable sub-versions of SECUR32.DLL. But as usual, it seems the detection logic is faulty, and nothing I've tried so far has been successful. Now that 128 bit NTLMv2 is becoming mandatory (by default), this is a real problem.

The alternative theory is that all the stuff in the KB's describing these two sub-versions is pure fantasy. That's why I question if anyone has ever seen the 128 bit version of SECUR32.DLL as described (ie. identified as "(US and Canada only)" in its version description). I guess that version description comes from the time when 128 bit encryption software was restricted to USA and Canada (I can't recall when that restriction eased, although it must have been around the time of IE 5.5).

The various DSClient installer packages seem to contain only the "Export" version of SECUR32.DLL when you open them with TugZip or 7Zip. Different versions seem to exist for W95, W98 and W98SE. Perhaps the "US and Canada only" sub-version is produced by the DSClient installer by patching the "Export" version.

The only new lead I've encountered in the past day or so, is that the Q323466 update for DSClient (not clear from the archived KB just what that update fixes) is (also?) included in a file called "5234_ENU_i386_zip.exe". Haven't been able to locate it, nor do I know if it will be any better at producing the 128 bit version of SECUR32.DLL.

Joe.

This post has been edited by jds: 13 November 2010 - 11:24 PM

[PROBLEMCHYLD]

Have you tried the file MSIE128.EXE?