• Utilities and SDK for Subsystem for UNIX-based Applications (SUA)

This hotfix incorporates daylight saving time (DST) changes in Pakistan and in Morocco in 2008.

Back to the top

• Subsystem for UNIX-based Applications in Windows Server 2003 R2
• Subsystem for UNIX-based Applications in Windows Vista
• Subsystem for UNIX-based Applications in Windows Server 2008

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, it is intended to correct only the problem that is described in this article. Apply it only to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

To resolve this problem immediately, contact Microsoft Customer Support Services to obtain the hotfix. For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

To apply this hotfix, you must have one of the following products installed:

• Subsystem for UNIX-based Applications in Windows Server 2003 R2
• Subsystem for UNIX-based Applications in Windows Vista
• Subsystem for UNIX-based Applications in Windows Server 2008

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Utilities and SDK for SUA for Windows Server 2003 R2, x86-based versions

Utilities and SDK for SUA for Windows Server 2003 R2, x64-based versions

Utilities and SDK for SUA for Windows Server 2008, 32-bit versions, for Windows Vista, 32-bit versions, for the Windows Vista Service Pack 1, 32-bit version, and for the Windows Server 2008 Server Core, 32-bit version

Utilities and SDK for SUA for Windows Server 2008, 64-bit versions, for Windows Vista, 64-bit versions, for the Windows Vista Service Pack 1, 64-bit version, and for the Windows Server 2008 Server Core, 64-bit version

Utilities and SDK for SUA for Windows Server 2008, Itanium-based versions, and for the Windows Server 2008 Server Core, Itanium-based version

Back to the top

Back to the top

More information for Windows Vista and for Windows Server 2008

Windows Vista, 32-bit versions, Windows Server 2008, 32-bit versions, and the Windows Server 2008 Server Core, 32-bit version

Windows Vista, 64-bit versions, Windows Server 2008, 64-bit version, and the Windows Server 2008 Server Core, 64-bit version

Windows Server 2008, Itanium-based versions, and the Windows Server 2008 Server Core, Itanium-based version

Back to the top

For more information about DST and about DST-related information, visit the following Microsoft Web site:

To download Utilities and SDK for Subsystem for UNIX-based Applications for Windows Vista and for Windows Server 2008, visit the following Microsoft Web site:

To download Utilities and SDK for Subsystem for UNIX-based Applications for Windows Server 2003 R2, visit the following Microsoft Web site:

Back to the top

This article describes how to obtain this tool. This article also provides an operational overview of the tool. This overview includes system requirements and command-line parameters. Finally, this article describes the most common problems that you may encounter when you use the tool.

Back to the top

How to obtain the BitLocker Drive Preparation Tool

Windows Vista Ultimate

If you are using Windows Vista Ultimate, follow these steps to obtain the tool:

1.	Click Start, type Windows Update in the Start Search box, and then press ENTER.
2.	Click Check for updates.
3.	Click View available Extras.
4.	Click to select the BitLocker and EFS enhancements check box, and then click Install.

Windows Vista Enterprise

If you are using Windows Vista Enterprise, use the following services to obtain this tool:

•

Microsoft Customer Support Services For a complete list of Microsoft Customer Support Services telephone numbers, visit the following Microsoft Web site:For more information, visit the following Microsoft Web page: http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Back to the top

After the tool finishes preparing the drive, you must restart the computer. Then, you can use the Security item in Control Panel to enable BitLocker.

Back to the top

How to prepare the hard disk for BitLocker Drive Encryption

To encrypt drives and to verify boot integrity, BitLocker requires at least two partitions. These two partitions make up a split-load configuration. A split-load configuration separates the main operating system partition from the active system partition from which the computer starts.

The BitLocker Drive Preparation Tool automates the following processes to make the computer ready for BitLocker:

•	Creating the second volume that BitLocker requires
•	Migrating the boot files to the new volume
•	Making the volume an active volume

When the tool finishes, you must restart the computer to change the system volume to the newly created volume. After you restart the computer, the drive will be configured correctly for BitLocker. You may also have to initialize the Trusted Platform Module (TPM) before you turn BitLocker on.

Back to the top

System requirements

To create a new partition or to merge unallocated space with an existing partition, the target system must meet the following requirements:

•	A genuine version of Windows Vista Ultimate or Windows Vista Enterprise must be installed.
•	The active partition must contain boot configuration data and boot files.
•	The target partition must meet the following requirements: • The partition must be on a simple disk that is initialized for basic storage. • The partition must be a primary partition. Extended drives and logical drives are not supported. • The partition must be formatted by using the NTFS file system. • The partition must not be compressed. • The cluster size of the partition must be less than 4 KB or equal to 4 KB. • The partition is not using software spanning, software mirroring, or software RAID. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 314343 (/Feedback.aspx?kbNumber=314343/) Basic storage versus dynamic storage in Windows XP Note This tool works correctly in hardware RAID configurations. • For a split operation, at least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). • For a merge operation, the partition’s total capacity must be at least 1.5 GB. Also, the partition must have at least 800 MB of free disk space.

The following chart shows the target system requirements.

Back to the top

Operational overview

Target system configurations

The BitLocker Drive Preparation Tool supports Windows Vista Ultimate and Windows Vista Ultimate Enterprise. This tool successfully creates a split-load configuration when the active state, the system state and the boot state are all assigned to the same simple volume.

Default operational procedure

When the BitLocker Drive Preparation Tool starts, it tries to create a split-load configuration by using the following methods, in order of preference:

•	Merge unallocated space with a type 0×7 Windows Recovery (WinRE) partition
•	Create a new partition from unallocated space
•	Split an existing partition Note The tool tries to split the current active partition. If this action fails, the tool splits the largest available partition.
•	Merge unallocated space with the smallest suitable partition

Preferred order of operations

The following chart shows the preferred order of operations that the BitLocker Drive Preparation Tool follows.

Back to the top

Command-line parameters

The BitLocker Drive Preparation Tool uses a simple set of command-line parameters. These parameters make integration with enterprise deployment tools more flexible. Enterprise deployment tools include Microsoft Systems Management Server (SMS) and Microsoft Business Desktop Deployment (BDD). The parameters also provide customized deployment options. The following table lists the parameters. The parameters are not case-sensitive.

Parameter	Description	Notes
[-?] [/?]	Help – Provides a brief description of the tool’s purpose and parameters
[-driveinfo]	Displays the drive letter, the total size, the maximum free space, and the partition characteristics	Only valid partitions are listed. Characteristics are noted only for WinRE, operating system, and unallocated partitions.
[-target {unallocated ¦ drive: {shrink ¦ merge}}]	Indicates the desired operation for target partition: create a new partition from unallocated disk space, split the target partition to create a new partition, or merge unallocated space with the target partition	Cannot merge unallocated spaced with the operating system partition. Unallocated space is not listed if four primary or extended partitions already exist.
[-newdriveletter] ¦ DriveLetter:]	Indicates the drive letter for the newly created partition	Letters A, B, and C are excluded. If no letter is indicated, the first available drive letter backward from S is applied.
[-size ¦ SizeInMegabytes]	Indicates the size in megabytes for the new partition	The minimum size is 1500 MB. At least 10 percent of the target partition must be free after the new partition is created.
[-quiet]	Suppresses confirmation text to avoid user interaction
[-restart]	Restarts the system immediately after all operations are complete	Restarts immediately, regardless of open files or other users logged in.

Example scenario 1

The target system has a single partition. To prepare the computer for BitLocker, you want to split the operating system partition. You want the following conditions to be true:

•	The size of the new partition is 1500 MB.
•	The new partition uses X for the drive letter.
•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Example scenario 2

The target system has more than one partition. To prepare the computer for BitLocker, you want to merge unallocated space with an existing partition. You want the following conditions to be true:

•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Back to the top

A common problem

You may receive the following error message when you use the BitLocker Drive Preparation Tool:

This error may occur in one of the following scenarios.

Scenario 1: You do not have sufficient free disk space

At least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). To resolve this error, move files to another partition or delete files.

Scenario 2: The partition contains files that cannot be moved

The BitLocker Drive Preparation Tool may resize partitions to prepare a hard disk for BitLocker. Occasionally, some unmovable files may prevent the tool from defragmenting and resizing partitions. These files may include any of the following items:

•	Page files
•	Hibernation files (Hiberfil.sys)
•	The registry
•	NTFS metadata files. These files include the following files and others: • $mftmirr • $secure • $volume

This issue may occur even if the operating system is newly installed.

To work around this error, use one of the following methods:

•	Temporarily disable hibernation option and hard disk paging. Then, use the Windows Preinstallation Environment to delete the Hiberfil.sys file and the Pagefile.sys file. Restart the computer in Windows Vista. Then, run the BitLocker Drive Preparation Tool again.
•	Reinstall Windows Vista.

Back to the top

You receive an error message when you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer

When you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer that is running Windows Vista, you may receive the following error message:

To resolve this problem, follow these steps.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1.	Click Start, type regedit in the Start Search box, and then click regedit in the Programs list.
2.	Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management
3.	Verify the data type of the PagingFiles registry entry. If the data type is REG_SZ, follow these steps: a. Note the value data for the PagingFiles registry entry. b. Back up the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management c. Right-click PagingFiles, and then click Delete. d. Click Yes when you are prompted. e. On the Edit menu, point to New, and then click Multi-String Value. f. Type PagingFiles, and then press ENTER. g. On the Edit menu, click Modify. h. In the Value data box, type the value data that you noted in step 3a, and then click OK. i. Exit Registry Editor.
4.	Restart the computer.

For more information about security for portable computers that are running Windows Vista, visit the following Lenovo Web site:

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Back to the top

Addresses that should be shown in the Do not use proxy server for addresses beginning with section under the Internet Options Advanced Proxy Settings page are not shown. The registry entries still exist and Internet Explorer will still bypass the Web sites.

Back to the top

This is caused by the configuration of different proxy servers by protocol, where one is the Gopher proxy server.

 

Note Internet Explorer 7 does not support the Gopher protocol. For this problem to occur, the Gopher protocol would have to have been set in older Group Policies or from an earlier version of Internet Explorer before Internet Explorer 7 was installed.

Back to the top

If the configuration was set through Group Policy

 

·         Remove the value for the Gopher proxy server specified in the Group Policy.

 

If the configuration was not set through Group Policy

 

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

 

                322756 (/Feedback.aspx?kbNumber=322756) How to back up and restore the registry in Windows

 

To modify the registry entry, follow these steps:

 

1.       Click Start, click Run, and in the Open box, type the following:

 regedit

 

2.       Locate the ProxyServer value under the following key in the registry:

HKEY_CURRENT_USER Software Microsoft Windows CurrentVersion Internet Settings

3.       On the Edit menu, click Edit, String.

4.       Remove the entry associated with Gopher (for example, remove gopher=proxyserver:80;), and then click OK . 

5.       Exit Registry Editor. 

Back to the top

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Back to the top

This issue occurs if a Web site that you browse is an Active Server Pages (ASP) page that calls a .NET-managed component.

Note This .NET-managed component uses .NET interop functionality.

Back to the top

Back to the top

Hotfix information for Windows XP

A supported hotfix is now available from Microsoft. However, it is intended to correct only the problem that is described in this article. Apply it only to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows XP service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Customer Support Services to obtain the hotfix. For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

To apply this hotfix, you must have Windows XP Service Pack 2 (SP2) installed.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File name	File version	File size	Date	Time	Platform
Urlmon.dll	7.0.6000.20733	1,162,752	07-Dec-2007	05:53	x86

Back to the top

Hotfix information for Windows Server 2003

A supported hotfix is now available from Microsoft. However, it is intended to correct only the problem that is described in this article. Apply it only to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows Server 2003 service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Customer Support Services to obtain the hotfix. For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

To apply this hotfix, you must have Windows Server 2003 Service Pack 2 installed.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File name	File version	File size	Date	Time	Platform
Urlmon.dll	7.0.6000.20733	1,162,752	06-Dec-2007	19:32	x86

Back to the top

Hotfix information for Windows Vista

A supported hotfix is now available from Microsoft. However, it is intended to correct only the problem that is described in this article. Apply it only to systems that are experiencing this specific problem. This hotfix may receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows Vista service pack that contains this hotfix.

To resolve this problem immediately, contact Microsoft Customer Support Services to obtain the hotfix. For a complete list of Microsoft Customer Support Services telephone numbers and information about support costs, visit the following Microsoft Web site:

Note In special cases, charges that are ordinarily incurred for support calls may be canceled if a Microsoft Support Professional determines that a specific update will resolve your problem. The usual support costs will apply to additional support questions and issues that do not qualify for the specific update in question.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

File name	File version	File size	Date	Time	Platform
Update.mum	Not Applicable	2,031	05-Dec-2007	12:47	Not Applicable
X86_395ee482d2c34d4bc21bf30dc6c83930_31bf3856ad364e35_6.0.6000.20733_none_6a8300a61a7b767b.manifest	Not Applicable	724	05-Dec-2007	12:47	Not Applicable
X86_microsoft-windows-i..ersandsecurityzones_31bf3856ad364e35_6.0.6000.20733_none_b369071af2d69a04.manifest	Not Applicable	283,492	05-Dec-2007	12:47	Not Applicable
Urlmon.dll	7.0.6000.20733	1,162,752	05-Dec-2007	04:09	x86

After you apply this hotfix, follow these steps to enable the changes that the hotfix makes:

1.	Click Start, click Run, type regedit , and then click OK.
2.	Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE SOFTWARE Microsoft Internet Explorer MAIN FeatureControl FEATURE_IGNORE_ZONES_INITIALIZATION_FAILURE_KB945701
3.	Right-click FEATURE_IGNORE_ZONES_INITIALIZATION_FAILURE_KB945701, point to New, and then click DWORD Value.
4.	Type w3wp.exe to name the new registry entry, and then press ENTER.
5.	Right-click w3wp.exe, and then click Modify.
6.	In the Value data box, type 1, and then click OK.
7.	Exit Registry Editor.

Note You must apply this hotfix on the Web server that is running Internet Information Services (IIS).

Back to the top

Back to the top

In this scenario, when you try to start Internet Explorer 7 on an alternative desktop, the Internet Explorer 7 browser window does not open. Instead, the Internet Explorer 7 browser window opens on the default desktop.

Back to the top

Because there is one broker process per user, protected mode allows browser windows to open only on the default desktop.

Back to the top

Back to the top

This article discusses the Firewall application requirements necessary for Toredo to coexist with those firewalls on a Windows operating system-based computer.

Back to the top

In order for client firewalls to coexist with Teredo, the firewalls must follow the guidelines listed below.

 

 

1. The client firewall must allow resolution of teredo.IPv6.microsoft.com.

2. The client firewall must exempt UDP IPv4 traffic to/ from remote UDP port 3544.

        a. Port 3544 allows the client to communicate to the Teredo Server.

3. Client firewalls must support the following ICMPv6 error messages & discovery functions:

        a. ICMPv6 Neighbor Solicitation / Neighbor Advertisement

                1. The codes for these are 135 and 136

        b. ICMPv6 Echo Request/ Reply

                1. The codes for these are 128 and 129

        c. Packet Too Big

                1. The code for this is 2

        d. Parameter Problem

                1. The code for this  is 4

        e. Time Exceeded

                1. The codes for this is 3

        f. Destination Unreachable

                1. The code for this is 1

 

Note:  If the above ICMPv6 messages cannot be specifically allowed, then the exemption of all ICMPv6 messages should be enabled on the firewall

 

4. The client firewall should allow the system to send and receive UDP/IPv4 packets to UDP port 1900 

        a. Port 1900 allows UPnP discovery traffic to flow, and while is not necessary, will improve connectivity rates.

 

To troubleshoot if you are having a Teredo problem, please run the command from a command prompt:

netsh int teredo show state

 

Review the “State field in the Teredo parameters using the command above and do the following:

·         If the Teredo State is offline then follow steps 1, 2 and 3 above

·         If the Teredo State is dormant or qualified, then do step 3 only

 

Note: Perform step 4 to achieve best performance.

 

For more information on Teredo please refer to the following article below

http://www.microsoft.com/technet/network/ipv6/teredo.mspx (http://www.microsoft.com/technet/network/ipv6/teredo.mspx)

 

Note: Windows XP SP1 must have the Advanced Networking Pack for Windows XP (http://www.microsoft.com/downloads/details.aspx?familyid=E88CC382-8CE6-4739-97C0-1A52A6F005E4&displaylang=en) installed

 

 

 

Back to the top

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Back to the top

Back to the top

Back to the top

Back to the top

To help resolve this issue, ask the gadget developer to supply the language for the gadget.

Note You may be able to resolve this issue by installing a language pack that includes a language that matches the language in the gadget. For more information about how to install more languages, see Windows Help and Support.

Back to the top

Back to the top

Issues that the hotfix package fixes

List of issues that are fixed

This hotfix fixes the following issues:

•	954540 (/Feedback.aspx?kbNumber=954540/) The changes in the TOC and PageRef fields do not appear when you compare Word 2007 documents
•	954541 (/Feedback.aspx?kbNumber=954541/) The Ref field is updated incorrectly when you print a Word 2007 document

This hotfix fixes the following issues that are not previously documented in a Microsoft Knowledge Base article:

•	When you compare and merge documents that are written in Chinese characters or in Japanese characters in Word 2007, the text that is marked as deleted and inserted is much larger than the text that is actually changed. For example, if you delete only one character or one word, a large chunk of text around this character or word is marked as deleted. Additionally, the chunk of text is marked as reinserted, except for the character or for the word that is actually deleted. Note The issue occurs for both character-level comparison and word-level comparison. However, this issue does not occur if you delete the word or the character at the end of the sentence.
•	Consider the following scenario. You create and then save a new document from a template on a trusted network share. This template contains Microsoft Visual Basic for Application (VBA) code. Then, you open the document again. In this scenario, you cannot save the document again. Additionally, you receive the following error message: The save failed due to out of memory or disk space.
•	Consider the following scenario. You create and then save a document that contains a table. You delete one row, and you modify the content in the following row. Then, you save the document as a different name. In this scenario, if you compare the revised document to the original document, the result is incorrect.
•	Consider the following scenario. You create a Microsoft Office Word 2003 document, and you apply a new style such as Style1 to some paragraphs that have outline numbering enabled. Then, you change the number format of Style1. To change this number format, you add text before the number in that document. In this scenario, when you use the Compare Documents functionality to compare the revised document to the original document, the comparison document shows the formatting as the formatting in the original document. However, the comparison document should show the formatting as the formatting in the revised document.
•	You create a document that is based on a template that has customized Ribbons. When you open the document, Word 2007 may not display the Ribbon customizations. This issue can occur if the following conditions are true: • The template uses the editing restriction, Filling in forms. Note This issue does not occur if the template is unprotected or if the template uses one of the following editing restrictions: • Comments • No changes (Read only) • Tracked changes • The document is saved in one of the following file formats: • Word 2003 XML Document (*.xml) • Word XML Document (*.xml) • Word Document (*.docx) • Word Macro-Enabled Document (*.docm) Note This issue does not occur if the document is saved in a rich text format (RTF) or in a binary document file format. However, the template is still correctly loaded as a base template.
•	When you add one or more letters at the beginning or at the end of a word, a word-level comparison only marks the inserted letters as an insertion, as if the inserted characters are a separate word. The expected behavior is that the original word should be marked as deleted, and the new word should be marked as an insertion.
•	If you click to clear the White space check box in the Compare Documents dialog box, the closing paragraph mark of an insertion is ignored. The expected behavior is that the closing paragraph mark should be displayed as part of the insertion, and the closing paragraph mark should not be ignored.
•	When you insert or delete a text box in the revised document, and then you compare this document to the original document, there is a revision bar next to the border of the text box. However, there is no revision markup in the text box.
•	If two plain text content controls are grouped, you may experience the following issues when you run the Spelling and Grammar check: • The last word in the first content control is selected together with part of the first word of the second content control. This behavior occurs when the following conditions are true: • There is no space after the last word in the first content control. • The last word of the first content control is proofed in the Spelling and Grammar dialog box. This issue occurs whether the last word of the first content control is spelled correctly. • After the last word of the first content control is proofed, the Spelling and Grammar check is complete. However, misspelled words are not checked in the second content control.

Back to the top

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

There are no prerequisites for installing this hotfix.

Restart information

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix package does not replace any other hotfix packages.

Registry information

You do not have to make any changes to the registry.

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article.

The Global version of this hotfix uses a Microsoft Windows Installer package to install the hotfix. The dates and the times for these files are listed in Coordinated Universal Time (UTC) in the following table. When you view the file information, the date is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Download information

File name	File version	File size	Date	Time	Platform
Office-kb954576-fullfile-x86-glb.exe	12.0.6320.5000	15,929,040	19-Jun-2008	14:28	x86

Microsoft Windows Installer .msp file information

File name	File version	File size	Date	Time	Platform
Word.msp	Not Applicable	13,252,608	19-Jun-2008	18:33	Not Applicable
Wordconv.msp	Not Applicable	6,301,696	19-Jun-2008	18:33	Not Applicable

Word.msp file information

File name	File version	File size	Date	Time	Platform
Msword.olb	12.0.6300.5000	768,024	06-Dec-2007	17:05	Not Applicable
Winword.exe	12.0.6320.5000	349,720	19-Jun-2008	15:00	x86
Wwlib.dll	12.0.6320.5000	17,491,480	19-Jun-2008	15:00	x86

Wordconv.msp file information

File name	File version	File size	Date	Time	Platform
Wordcnv.dll	12.0.6320.5000	4,281,368	19-Jun-2008	22:42	x86
Wordconv.exe	12.0.6300.5000	24,584	13-Dec-2007	01:08	x86

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Additionally, you may experience the following behavior when this problem occurs:

• If you disconnect from and then reconnect to the terminal server, the problem is resolved.
• If you redraw the components in the application, this problem is not resolved. For example, if you may try to make the components smaller or larger, this problem is not resolved.
• If you capture a screen shot of the Terminal Services session, you see the components are drawn correctly in the screen shot.

This problem does not occur with RDC 6.0 or earlier versions.

Back to the top

Back to the top

Hotfix information

Windows XP

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, submit a request to Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix, you must have Windows XP Service Pack 3 installed on the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows XP with Service Pack 3, x86-based versions

Windows Vista and Windows Server 2008

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix on Windows Vista-based computer, you must have Windows Vista SP1 installed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

No prerequisites are required for Windows Server 2008-based computers.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista and Windows Server 2008 file information notes
The MANIFEST files (.manifest) and MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.
For all supported x86-based versions of Windows Server 2008 and Windows Vista

For all supported x64-based versions of Windows Server 2008 and Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Back to the top

Additional file information for Windows Server 2008 and Windows Vista

Additional files for all supported x86-based versions of Windows Server 2008 and Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and Windows Vista

Additional files for all supported IA-64-based versions of Windows Server 2008

Back to the top

Note Windows Vista application compatibility updates are cumulative. Each update contains all the improvements that were included in the previous application compatibility updates.

To immediately install the latest application compatibility update, click Start, point to All Programs, and then click Windows Update. In the navigation pane, click Check for updates, and then follow the steps to install all recommended updates.

Back to the top

How to obtain the latest Windows Vista application compatibility update

To obtain the latest Windows Vista application compatibility update, use one of the following methods.

Back to the top

Method 1: Enable automatic updates (recommended)

Enable the automatic updates feature in Windows Vista. This is the recommended method to receive the latest updates. This method helps make sure that you always receive the latest updates.

To enable the automatic updates feature, follow these steps:

1.	Click Start, point to All Programs, and then click Windows Update.
2.	In the navigation pane, click Change settings.
3.	Select the Windows automatic updates setting that you want.
4.	Click to select the Include recommended updates when downloading, installing, or notifying me about updates check box, and then click OK. If you are prompted for an administrator password or for confirmation, type the password, or provide confirmation.

Back to the top

Method 2: Check for updates on Windows Update

Instead of receiving updates automatically, you can manually check for updates through Windows Update. To do this, follow these steps:

1.	Click Start, point to All Programs, and then click Windows Update.
2.	In the navigation pane, click Check for updates.
3.	After Windows Update has finished checking for updates, click View available updates.
4.	Click to select the check boxes for the updates that you want to install, and then click Install. If you are prompted for an administrator password or for confirmation, type the password, or provide confirmation.

Back to the top

Method 3: Download the Windows Vista application compatibility update from the Microsoft Download Center

The following files are available for download from the MicrosoftDownload Center:

Download the Update for Windows Server 2008 package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=8C188627-767A-451F-9C0C-79F2FEC4E3F6&displaylang=en)
Download the Update for Windows Server 2008 for Itanium-based Systems package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=7872AD8E-BB96-4F5D-AE0F-F982BABF7FB9&displaylang=en)
Download the Update for Windows Server 2008 x64 Edition package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=63005D06-6578-4C1C-A351-FADDA2EDDF96&displaylang=en)
Download the Update for Windows Vista package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=49AA7826-8543-4F24-8F88-46E454DF3063&displaylang=en)
Download the Update for Windows Vista for x64-based Systems package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=9554B1DC-5271-41D1-884F-AD0E58BED4F8&displaylang=en)

Release Date: May 2008

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Back to the top

Issues that are resolved by Windows Vista application compatibility updates

Windows Vista application compatibility updates resolve the following issues that you may experience when you try to install and run certain legacy games or applications in Windows Vista:

•	The game, the application, or the firmware is installed incorrectly.
•	The game, the application, or the firmware causes system instability.
•	The primary functions of the game, of the application, or of the firmware do not work correctly.

Back to the top

Changes in application behavior after you install the latest Windows Vista application compatibility update

After you install the latest Windows Vista application compatibility update, this update controls the behavior of certain applications to improve the performance of Windows Vista. The Windows Vista application compatibility update uses the following methods to control the behavior of applications:

•	Hard block This method applies a hard block on the application. A hard block prevents an application that is incompatible with Windows Vista from running on the computer. Note Microsoft applies hard blocks only on a non-Microsoft application when the manufacturer of the application gives its consent.
•	Soft block This method applies a soft block on the application. A soft block provides notification when an application that is incompatible with Windows Vista starts to run.
•	Shim update This method improves the performance of an application in Windows Vista.

The following table shows all the applications that are included in the latest Windows Vista application compatibility update and the behavior of the applications after you install the update.

Applications that are included in the May 2008 update

Applications that are included in the December 2007 update

Applications that are included in the July 2007 update

Applications that are included in the March 2007 update

Applications that are included in the January 2007 update

For more information about the previously released Windows Vista application compatibility updates, click the following article numbers to view the articles in the Microsoft Knowledge Base:

Back to the top

How to troubleshoot application compatibility issues that are not resolved by the latest Windows Vista application compatibility update

After you install the latest Windows Vista application compatibility update, you may still experience application compatibility issues. To resolve these issues, use one or more of the following troubleshooting options in the order in which they are presented:

•	Restart the computer after you install the Windows Vista application compatibility update to allow for any additional process to be completed and for drivers to be loaded correctly. If the program still does not work, go to the next option.
•	Run the program in compatibility mode. When you select the compatibility mode option, Windows Vista emulates the selected operating system when you run that particular program. To run the program in compatibility mode, follow these steps: 1. Click Start, type the name of the program in the Start Search box, and then press ENTER. 2. In the Programs list, right-click the program name, and then click Properties. 3. On the Compatibility tab, click to select the Run this program in compatibility mode for check box. 4. In the list, select an operating system, and then click OK. If the program still does not work correctly, go to the next option.
•	Contact the program vendor or hardware manufacturer. If a program does not run in Windows Vista, or if a piece of hardware does not function as expected after you install Windows Vista, contact the program vendor or the hardware manufacturer for guidance about how to troubleshoot the issue. Typically, the software vendor Web site provides a support section that includes more information about compatibility. Frequently, the software vendor provides one of the following resolutions to resolve compatibility issues: • An update to make the current version of the program compatible with Windows Vista • A version of the program that is compatible with Windows Vista • Information about any configuration changes to make the program compatible with Windows Vista

For information about how to contact hardware and software vendors, visit the following Microsoft Web site:

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.
The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.

Back to the top

In this scenario, the application may crash.

Back to the top

Back to the top

Windows Vista hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista with Service Pack 1, x86-based versions

Windows Vista, x64-based versions

Windows Vista with Service Pack 1, x64-based versions

Windows Vista with Service Pack 1, Itanium-based versions

Back to the top

Windows Server 2008 hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2008, x86-based versions

Windows Server 2008, Itanium-based versions

Windows Server 2008, x64-based versions

Back to the top

Back to the top

For more information about how an application can provide performance counter data by using the performance counter version 2.0 APIs, visit the following Microsoft Web site:

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

However, you may notice that the audio application cannot play the following formats:

• The latest non-PCM formats, such as Dolby True HD
• Both PCM and non-PCM audio formats that are encrypted

Back to the top

When the audio application selects a specific audio format to transfer stream data, the audio miniport driver should see the corresponding KSDATAFORMAT structure that contains the specific GUID and other parameters in the miniport’s handlers. For example, the audio miniport driver should see the NewStream() parameter. When the audio driver encounters these parameters, the driver takes some action, based on the specific GUID.

However, in Windows Vista-based or Windows Server 2008-based computers, the system audio stack (Portcls.sys) may pass a KSDATAFORMAT instance with a different GUID to the WaveRT miniport’s NewStream() parameter.

For example, there can be two data ranges that have the same sample rates, but the data ranges have a different number of channels. In this case, the system may detect one data range that is the first data range that matches the sample rate and the sample bit in the array. However, the channel number is incorrect.

Therefore, the audio driver does not obtain the correct data format. Because the driver does not obtain the correct data format, the audio driver cannot function correctly with regard to the audio format that was selected in the application, and the function fails.

Back to the top

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required to install this hotfix.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.600 0 . 20 xxx	Windows	RTM	LDR
  6.0.600 1 . 22 xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000.xxxxxx version number.
• The MANIFEST files (.manifest) and MUM files (.mum) installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported 32-bit versions of Windows Server 2008 and of Windows Vista

For all supported 64-bit versions of Windows Server 2008 and of Windows Vista

For all supported Itanium-based versions of Windows Server 2008

Back to the top

For more information about WAVEFORMATEXTENSIBLE, visit the following Web site:

For more information about KSDATAFORMAT, visit the following Web site:

For more information about WaveRT, visit the following Web sites:

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported 32-bit versions of Windows Server 2008 and of Windows Vista

Additional files for all supported 64-bit versions of Windows Server 2008 and of Windows Vista

Additional files for all supported Itanium-based versions of Windows Server 2008

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

treeDiv = srcDoc.createElement(DIV);treeDiv.id = treeDiv;treeDiv.className = treeDiv;treeDiv.style.pixelTop = 0;scrollDiv.appendChild(treeDiv);treeDiv.onresize = treeResize;treeDiv.innerHTML = loadTree(treeXML);

Back to the top

• Home users:
  http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx)

  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:

  http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx (http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx)

Back to the top

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

For enterprise customers, support for security updates is available through your usual support contacts.

Back to the top

Known issues with this security update

Symptoms

After you apply this security update, applications such as Microsoft SQL Server or Internet Information Services (IIS) may fail when they make local NTLM authentication requests.

Cause

This problem occurs because of the way that NT LAN Manager (NTLM) treats different naming conventions as remote entities instead of as local entities. A local authentication failure might occur when the client calculates and caches the correct response to the NTLM challenge that is sent by the server in local lsass memory before the response is sent back to the server. When the server code for NTLM finds the received response in the local lsass cache, the code does not honor the authentication request and treats it as a replay attack. This behavior leads to a local authentication failure.

Resolution

To resolve this problem, you must disable reflection protection so that the affected systems can be authenticated. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

How to disable NTLM reflection protection

ImportantThis section, method, or task contains steps that tell you how to change the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To disable NTLM reflection protection, you must modify a registry key on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck for the name of the DWORD, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection

Because the NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system by setting DisableLoopbackCheck to 1 returns the system to a vulnerable state. Therefore, we strongly recommend that you use the BackConnectionHostNames registry key if needed.

How to re-enable NTLM reflection protection

To re-enable NTLM reflection protection, you must modify a registry entry on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. Right-click DisableLoopbackCheck, and then click Modify.
4. In the Value data box, type 0, and then click OK.
5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

How to disable NTLM reflection protection for a particular SPN

You can disable NTLM reflection protection for a particular Service Principal Name (SPN) that is causing the corresponding authentication to break.To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. On the Edit menu, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames for the name of the Multi-String Value, and then press ENTER.

   Note If the BackConnectionHostNames registry entry exists as a REG_DWORD, you must delete the BackConnectionHostNames registry entry.

5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection for a particular SPN

Because NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system will return the system to a vulnerable state for the particular SPN for which the reflection protection was disabled.

How to re-enable NTLM reflection protection for a particular SPN

To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. Right-click BackConnectionHostNames, and then click Modify.
4. In the Value data box, delete the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

Back to the top

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

For all supported editions of Microsoft Windows 2000 Service Pack 4

Windows XP and Windows Server 2003 file information notes

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the SP requirement and Service branch columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that has a Microsoft digital signature.

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows Server 2003 and of Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) have a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Back to the top

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista