The BitLocker Drive Preparation Tool is available. You can use this tool to prepare the computer for BitLocker Drive Encryption.

This article describes how to obtain this tool. This article also provides an operational overview of the tool. This overview includes system requirements and command-line parameters. Finally, this article describes the most common problems that you may encounter when you use the tool.

Back to the top

How to obtain the BitLocker Drive Preparation Tool

Windows Vista Ultimate

If you are using Windows Vista Ultimate, follow these steps to obtain the tool:

1.	Click Start, type Windows Update in the Start Search box, and then press ENTER.
2.	Click Check for updates.
3.	Click View available Extras.
4.	Click to select the BitLocker and EFS enhancements check box, and then click Install.

Windows Vista Enterprise

If you are using Windows Vista Enterprise, use the following services to obtain this tool:

•

Microsoft Customer Support Services For a complete list of Microsoft Customer Support Services telephone numbers, visit the following Microsoft Web site:For more information, visit the following Microsoft Web page: http://support.microsoft.com/contactus/?ws=support (http://support.microsoft.com/contactus/?ws=support)

Back to the top

When you install this tool, the tool adds an item to the Start menu. To start the BitLocker Drive Preparation Tool, use one of the following methods:

•	Click Start, point to All Programs, click Accessories, click System Tools, click BitLocker, and then double-click BitLocker Drive Preparation Tool.
•	Click Start, type BitLocker in the Start Search text box, and then click BitLocker Drive Preparation Tool in the Programs list.

After the tool finishes preparing the drive, you must restart the computer. Then, you can use the Security item in Control Panel to enable BitLocker.

Back to the top

How to prepare the hard disk for BitLocker Drive Encryption

To encrypt drives and to verify boot integrity, BitLocker requires at least two partitions. These two partitions make up a split-load configuration. A split-load configuration separates the main operating system partition from the active system partition from which the computer starts.

The BitLocker Drive Preparation Tool automates the following processes to make the computer ready for BitLocker:

•	Creating the second volume that BitLocker requires
•	Migrating the boot files to the new volume
•	Making the volume an active volume

When the tool finishes, you must restart the computer to change the system volume to the newly created volume. After you restart the computer, the drive will be configured correctly for BitLocker. You may also have to initialize the Trusted Platform Module (TPM) before you turn BitLocker on.

Back to the top

System requirements

To create a new partition or to merge unallocated space with an existing partition, the target system must meet the following requirements:

•	A genuine version of Windows Vista Ultimate or Windows Vista Enterprise must be installed.
•	The active partition must contain boot configuration data and boot files.
•	The target partition must meet the following requirements: • The partition must be on a simple disk that is initialized for basic storage. • The partition must be a primary partition. Extended drives and logical drives are not supported. • The partition must be formatted by using the NTFS file system. • The partition must not be compressed. • The cluster size of the partition must be less than 4 KB or equal to 4 KB. • The partition is not using software spanning, software mirroring, or software RAID. For more information, click the following article number to view the article in the Microsoft Knowledge Base: 314343 (/Feedback.aspx?kbNumber=314343/) Basic storage versus dynamic storage in Windows XP Note This tool works correctly in hardware RAID configurations. • For a split operation, at least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). • For a merge operation, the partition’s total capacity must be at least 1.5 GB. Also, the partition must have at least 800 MB of free disk space.

The following chart shows the target system requirements.

Back to the top

Operational overview

Target system configurations

The BitLocker Drive Preparation Tool supports Windows Vista Ultimate and Windows Vista Ultimate Enterprise. This tool successfully creates a split-load configuration when the active state, the system state and the boot state are all assigned to the same simple volume.

Default operational procedure

When the BitLocker Drive Preparation Tool starts, it tries to create a split-load configuration by using the following methods, in order of preference:

•	Merge unallocated space with a type 0×7 Windows Recovery (WinRE) partition
•	Create a new partition from unallocated space
•	Split an existing partition Note The tool tries to split the current active partition. If this action fails, the tool splits the largest available partition.
•	Merge unallocated space with the smallest suitable partition

Preferred order of operations

The following chart shows the preferred order of operations that the BitLocker Drive Preparation Tool follows.

Back to the top

Command-line parameters

The BitLocker Drive Preparation Tool uses a simple set of command-line parameters. These parameters make integration with enterprise deployment tools more flexible. Enterprise deployment tools include Microsoft Systems Management Server (SMS) and Microsoft Business Desktop Deployment (BDD). The parameters also provide customized deployment options. The following table lists the parameters. The parameters are not case-sensitive.

Parameter	Description	Notes
[-?] [/?]	Help – Provides a brief description of the tool’s purpose and parameters
[-driveinfo]	Displays the drive letter, the total size, the maximum free space, and the partition characteristics	Only valid partitions are listed. Characteristics are noted only for WinRE, operating system, and unallocated partitions.
[-target {unallocated ¦ drive: {shrink ¦ merge}}]	Indicates the desired operation for target partition: create a new partition from unallocated disk space, split the target partition to create a new partition, or merge unallocated space with the target partition	Cannot merge unallocated spaced with the operating system partition. Unallocated space is not listed if four primary or extended partitions already exist.
[-newdriveletter] ¦ DriveLetter:]	Indicates the drive letter for the newly created partition	Letters A, B, and C are excluded. If no letter is indicated, the first available drive letter backward from S is applied.
[-size ¦ SizeInMegabytes]	Indicates the size in megabytes for the new partition	The minimum size is 1500 MB. At least 10 percent of the target partition must be free after the new partition is created.
[-quiet]	Suppresses confirmation text to avoid user interaction
[-restart]	Restarts the system immediately after all operations are complete	Restarts immediately, regardless of open files or other users logged in.

Example scenario 1

The target system has a single partition. To prepare the computer for BitLocker, you want to split the operating system partition. You want the following conditions to be true:

•	The size of the new partition is 1500 MB.
•	The new partition uses X for the drive letter.
•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Example scenario 2

The target system has more than one partition. To prepare the computer for BitLocker, you want to merge unallocated space with an existing partition. You want the following conditions to be true:

•	During the operation, confirmation dialog boxes do not appear.
•	The system restarts when the operation is complete.

To use these settings, run the following command at a command prompt:

Back to the top

A common problem

You may receive the following error message when you use the BitLocker Drive Preparation Tool:

This error may occur in one of the following scenarios.

Scenario 1: You do not have sufficient free disk space

At least 10 percent of the active partition must remain free after the partition size is reduced by 1.5 gigabytes (GB). To resolve this error, move files to another partition or delete files.

Scenario 2: The partition contains files that cannot be moved

The BitLocker Drive Preparation Tool may resize partitions to prepare a hard disk for BitLocker. Occasionally, some unmovable files may prevent the tool from defragmenting and resizing partitions. These files may include any of the following items:

•	Page files
•	Hibernation files (Hiberfil.sys)
•	The registry
•	NTFS metadata files. These files include the following files and others: • $mftmirr • $secure • $volume

This issue may occur even if the operating system is newly installed.

To work around this error, use one of the following methods:

•	Temporarily disable hibernation option and hard disk paging. Then, use the Windows Preinstallation Environment to delete the Hiberfil.sys file and the Pagefile.sys file. Restart the computer in Windows Vista. Then, run the BitLocker Drive Preparation Tool again.
•	Reinstall Windows Vista.

Back to the top

You receive an error message when you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer

When you try to enable the BitLocker Drive Preparation Tool on an IBM portable computer that is running Windows Vista, you may receive the following error message:

To resolve this problem, follow these steps.

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.

1.	Click Start, type regedit in the Start Search box, and then click regedit in the Programs list.
2.	Locate and then click the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management
3.	Verify the data type of the PagingFiles registry entry. If the data type is REG_SZ, follow these steps: a. Note the value data for the PagingFiles registry entry. b. Back up the following registry subkey: HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Session Manager Memory Management c. Right-click PagingFiles, and then click Delete. d. Click Yes when you are prompted. e. On the Edit menu, point to New, and then click Multi-String Value. f. Type PagingFiles, and then press ENTER. g. On the Edit menu, click Modify. h. In the Value data box, type the value data that you noted in step 3a, and then click OK. i. Exit Registry Editor.
4.	Restart the computer.

For more information about security for portable computers that are running Windows Vista, visit the following Lenovo Web site:

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products.Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

Back to the top

You try to apply a theme to an ASP.NET 2.0 Web page. If the Web page contains a control that has the ToolboxBitmap attribute defined, you may receive the following error message:

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

You must have the Microsoft .NET Framework 2.0 installed to apply this hotfix.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

The .NET Framework 2.0, x86-based versions

The .NET Framework 2.0, Itanium architecture versions

The .NET Framework 2.0, x64-based versions

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the Applies to section.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Consider the following scenario:

•	In a Microsoft Office Word 2007 document, you enable Track Changes.
•	You insert a table into the document, and then you merge or split some cells in the table.

In this scenario, you expect the row that contains the merged or split cells to remain marked by Track Changes as a revision. Instead, this row is not marked as a revision.

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Office Word 2007 service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

There are no prerequisites for installing this hotfix package.

Restart information

You do not have to restart the computer after you apply this hotfix package.

Hotfix replacement information

This hotfix is not replaced by any later hotfix.

Registry information

To use one of the hotfixes in this package, you must either create a registry key or modify a registry key. You must set the value of the AlternateRevisionForTable registry subkey to 1. The AlternateRevisionForTable registry subkey resides in the following location:

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article. The global version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.Download information

File name	File version	File size	Date	Time	Platform
Office-kb941273-fullfile-x86-glb.exe	12.0.6300.5000	11,795,000	28-Jan-2008	17:55	x86

Microsoft Windows Installer .msp file information

File name	File version	File size	Date	Time	Platform
Word.msp	Not Applicable	13,064,704	28-Jan-2008	18:13	Not Applicable

Contents of the Word.msp file

File name	File version	File size	Date	Time	Platform
Winword.exe	12.0.6300.5000	349,720	12-Dec-2007	23:54	x86
Wwlib.dll	12.0.6300.5000	17,485,848	12-Dec-2007	23:54	x86

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the Applies to section.

Back to the top

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

This article discusses the Firewall application requirements necessary for Toredo to coexist with those firewalls on a Windows operating system-based computer.

In order for client firewalls to coexist with Teredo, the firewalls must follow the guidelines listed below.

 

 

1. The client firewall must allow resolution of teredo.IPv6.microsoft.com.

2. The client firewall must exempt UDP IPv4 traffic to/ from remote UDP port 3544.

        a. Port 3544 allows the client to communicate to the Teredo Server.

3. Client firewalls must support the following ICMPv6 error messages & discovery functions:

        a. ICMPv6 Neighbor Solicitation / Neighbor Advertisement

                1. The codes for these are 135 and 136

        b. ICMPv6 Echo Request/ Reply

                1. The codes for these are 128 and 129

        c. Packet Too Big

                1. The code for this is 2

        d. Parameter Problem

                1. The code for this  is 4

        e. Time Exceeded

                1. The codes for this is 3

        f. Destination Unreachable

                1. The code for this is 1

 

Note:  If the above ICMPv6 messages cannot be specifically allowed, then the exemption of all ICMPv6 messages should be enabled on the firewall

 

4. The client firewall should allow the system to send and receive UDP/IPv4 packets to UDP port 1900 

        a. Port 1900 allows UPnP discovery traffic to flow, and while is not necessary, will improve connectivity rates.

 

To troubleshoot if you are having a Teredo problem, please run the command from a command prompt:

netsh int teredo show state

 

Review the “State field in the Teredo parameters using the command above and do the following:

·         If the Teredo State is offline then follow steps 1, 2 and 3 above

·         If the Teredo State is dormant or qualified, then do step 3 only

 

Note: Perform step 4 to achieve best performance.

 

For more information on Teredo please refer to the following article below

http://www.microsoft.com/technet/network/ipv6/teredo.mspx (http://www.microsoft.com/technet/network/ipv6/teredo.mspx)

 

Note: Windows XP SP1 must have the Advanced Networking Pack for Windows XP (http://www.microsoft.com/downloads/details.aspx?familyid=E88CC382-8CE6-4739-97C0-1A52A6F005E4&displaylang=en) installed

 

 

 

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

•	The issues that the hotfix package fixes.
•	The prerequisites for installing the hotfix package.
•	Whether you must restart the computer after you install the hotfix package.
•	Whether the hotfix package is replaced by any other hotfix package.
•	Whether you must make any registry changes.
•	The files that the hotfix package contains.

Back to the top

Issues that the hotfix package fixes

List of issues that are fixed

This hotfix fixes the following issues:

•	954540 (/Feedback.aspx?kbNumber=954540/) The changes in the TOC and PageRef fields do not appear when you compare Word 2007 documents
•	954541 (/Feedback.aspx?kbNumber=954541/) The Ref field is updated incorrectly when you print a Word 2007 document

This hotfix fixes the following issues that are not previously documented in a Microsoft Knowledge Base article:

•	When you compare and merge documents that are written in Chinese characters or in Japanese characters in Word 2007, the text that is marked as deleted and inserted is much larger than the text that is actually changed. For example, if you delete only one character or one word, a large chunk of text around this character or word is marked as deleted. Additionally, the chunk of text is marked as reinserted, except for the character or for the word that is actually deleted. Note The issue occurs for both character-level comparison and word-level comparison. However, this issue does not occur if you delete the word or the character at the end of the sentence.
•	Consider the following scenario. You create and then save a new document from a template on a trusted network share. This template contains Microsoft Visual Basic for Application (VBA) code. Then, you open the document again. In this scenario, you cannot save the document again. Additionally, you receive the following error message: The save failed due to out of memory or disk space.
•	Consider the following scenario. You create and then save a document that contains a table. You delete one row, and you modify the content in the following row. Then, you save the document as a different name. In this scenario, if you compare the revised document to the original document, the result is incorrect.
•	Consider the following scenario. You create a Microsoft Office Word 2003 document, and you apply a new style such as Style1 to some paragraphs that have outline numbering enabled. Then, you change the number format of Style1. To change this number format, you add text before the number in that document. In this scenario, when you use the Compare Documents functionality to compare the revised document to the original document, the comparison document shows the formatting as the formatting in the original document. However, the comparison document should show the formatting as the formatting in the revised document.
•	You create a document that is based on a template that has customized Ribbons. When you open the document, Word 2007 may not display the Ribbon customizations. This issue can occur if the following conditions are true: • The template uses the editing restriction, Filling in forms. Note This issue does not occur if the template is unprotected or if the template uses one of the following editing restrictions: • Comments • No changes (Read only) • Tracked changes • The document is saved in one of the following file formats: • Word 2003 XML Document (*.xml) • Word XML Document (*.xml) • Word Document (*.docx) • Word Macro-Enabled Document (*.docm) Note This issue does not occur if the document is saved in a rich text format (RTF) or in a binary document file format. However, the template is still correctly loaded as a base template.
•	When you add one or more letters at the beginning or at the end of a word, a word-level comparison only marks the inserted letters as an insertion, as if the inserted characters are a separate word. The expected behavior is that the original word should be marked as deleted, and the new word should be marked as an insertion.
•	If you click to clear the White space check box in the Compare Documents dialog box, the closing paragraph mark of an insertion is ignored. The expected behavior is that the closing paragraph mark should be displayed as part of the insertion, and the closing paragraph mark should not be ignored.
•	When you insert or delete a text box in the revised document, and then you compare this document to the original document, there is a revision bar next to the border of the text box. However, there is no revision markup in the text box.
•	If two plain text content controls are grouped, you may experience the following issues when you run the Spelling and Grammar check: • The last word in the first content control is selected together with part of the first word of the second content control. This behavior occurs when the following conditions are true: • There is no space after the last word in the first content control. • The last word of the first content control is proofed in the Spelling and Grammar dialog box. This issue occurs whether the last word of the first content control is spelled correctly. • After the last word of the first content control is proofed, the Spelling and Grammar check is complete. However, misspelled words are not checked in the second content control.

Back to the top

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

There are no prerequisites for installing this hotfix.

Restart information

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix package does not replace any other hotfix packages.

Registry information

You do not have to make any changes to the registry.

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article.

The Global version of this hotfix uses a Microsoft Windows Installer package to install the hotfix. The dates and the times for these files are listed in Coordinated Universal Time (UTC) in the following table. When you view the file information, the date is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Download information

File name	File version	File size	Date	Time	Platform
Office-kb954576-fullfile-x86-glb.exe	12.0.6320.5000	15,929,040	19-Jun-2008	14:28	x86

Microsoft Windows Installer .msp file information

File name	File version	File size	Date	Time	Platform
Word.msp	Not Applicable	13,252,608	19-Jun-2008	18:33	Not Applicable
Wordconv.msp	Not Applicable	6,301,696	19-Jun-2008	18:33	Not Applicable

Word.msp file information

File name	File version	File size	Date	Time	Platform
Msword.olb	12.0.6300.5000	768,024	06-Dec-2007	17:05	Not Applicable
Winword.exe	12.0.6320.5000	349,720	19-Jun-2008	15:00	x86
Wwlib.dll	12.0.6320.5000	17,491,480	19-Jun-2008	15:00	x86

Wordconv.msp file information

File name	File version	File size	Date	Time	Platform
Wordcnv.dll	12.0.6320.5000	4,281,368	19-Jun-2008	22:42	x86
Wordconv.exe	12.0.6300.5000	24,584	13-Dec-2007	01:08	x86

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

After you apply hotfix 955572, you may receive an error message when you open an appointment in a shared calendar:

This issue may occur if the following conditions are true:

• You are the delegate in a delegate and manager scenario.
• You enable caching of shared folders.

  For more information about how to enable caching of shared folders, click the following article number to view the article in the Microsoft Knowledge Base:

  955572  (/Feedback.aspx?kbNumber=955572/ ) You cannot cache shared mail folders in Outlook 2007

To resolve this issue, apply hotfix 957692. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft has released security bulletin MS08-068. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx)

  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:

  http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx (http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx)

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

For enterprise customers, support for security updates is available through your usual support contacts.

Known issues with this security update

Symptoms

After you apply this security update, applications such as Microsoft SQL Server or Internet Information Services (IIS) may fail when they make local NTLM authentication requests.

Cause

This problem occurs because of the way that NT LAN Manager (NTLM) treats different naming conventions as remote entities instead of as local entities. A local authentication failure might occur when the client calculates and caches the correct response to the NTLM challenge that is sent by the server in local lsass memory before the response is sent back to the server. When the server code for NTLM finds the received response in the local lsass cache, the code does not honor the authentication request and treats it as a replay attack. This behavior leads to a local authentication failure.

Resolution

To resolve this problem, you must disable reflection protection so that the affected systems can be authenticated. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

How to disable NTLM reflection protection

ImportantThis section, method, or task contains steps that tell you how to change the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To disable NTLM reflection protection, you must modify a registry key on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck for the name of the DWORD, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection

Because the NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system by setting DisableLoopbackCheck to 1 returns the system to a vulnerable state. Therefore, we strongly recommend that you use the BackConnectionHostNames registry key if needed.

How to re-enable NTLM reflection protection

To re-enable NTLM reflection protection, you must modify a registry entry on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. Right-click DisableLoopbackCheck, and then click Modify.
4. In the Value data box, type 0, and then click OK.
5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

How to disable NTLM reflection protection for a particular SPN

You can disable NTLM reflection protection for a particular Service Principal Name (SPN) that is causing the corresponding authentication to break.To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. On the Edit menu, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames for the name of the Multi-String Value, and then press ENTER.

   Note If the BackConnectionHostNames registry entry exists as a REG_DWORD, you must delete the BackConnectionHostNames registry entry.

5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection for a particular SPN

Because NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system will return the system to a vulnerable state for the particular SPN for which the reflection protection was disabled.

How to re-enable NTLM reflection protection for a particular SPN

To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. Right-click BackConnectionHostNames, and then click Modify.
4. In the Value data box, delete the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

For all supported editions of Microsoft Windows 2000 Service Pack 4

Windows XP and Windows Server 2003 file information notes

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the SP requirement and Service branch columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that has a Microsoft digital signature.

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows Server 2003 and of Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) have a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported IA-64-based versions of Windows Server 2008

Microsoft has released security bulletin MS08-030. The security bulletin contains all the relevant information about the security update. This information includes deployment options. To view the complete security bulletin, visit one of the following Microsoft Web sites:

•	Home users: http://www.microsoft.com/protect/computer/updates/bulletins/200806.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200806.mspx) Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now: http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
•	IT professionals: http://www.microsoft.com/technet/security/bulletin/ms08-030.mspx (http://www.microsoft.com/technet/security/bulletin/ms08-030.mspx)

Back to the top

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

For enterprise customers, support for security updates is available through your usual support contacts.

Back to the top

Information about the re-release version of security update 951376 for all supported 32-bit editions of Windows XP (June 19, 2008)

Microsoft Security Bulletin MS08-030 has been re-released to re-offer the security update to customers who are running a 32-bit edition of Windows XP Service Pack 2 (SP2) or Windows XP Service Pack 3 (SP3). The Windows XP SP2 and Windows XP SP3 update that was offered in the security bulletin did not fully address the vulnerability that was discussed in the security bulletin. All other versions of the security update provide protection against the issues that were discussed in the security bulletin.

The purpose of reissuing this bulletin is to provide the updated version of the security update that affects Windows XP SP2 and Windows XP SP3. Customers who are running Windows XP SP2 and Windows XP SP3 should download and deploy this new security update.

Customers who are running Windows XP Professional x64 Edition, Windows XP Professional x64 Edition Service Pack 2, and all supported versions of Windows Vista and who have already applied these original security updates do not have to take any additional action.

The updated versions of the affected security updates will be made available through the same distribution channels as the original security updates. These distribution channels include Automatic Updates, Windows Update, and Windows Server Update Services.

Back to the top

Known issues with this security update

•	This issue does not affect Windows Server 2008. However, it is possible to install this security update on a Windows Server 2008-based computer. There are no known issues that may occur if you install this security update on a computer that is running Windows Server 2008.

Back to the top

File information

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

For all supported x64-based editions of Windows Vista

File name	File version	File size	Date	Time	Platform
Amd64_bth.inf_31bf3856ad364e35_6.0.6000.16682_none_cc28a24d77072a10.manifest	Not Applicable	3,402	30-Apr-2008	00:04	Not Applicable
Amd64_bth.inf_31bf3856ad364e35_6.0.6000.20824_none_ccf5211a8ff25209.manifest	Not Applicable	3,402	30-Apr-2008	00:04	Not Applicable
Amd64_bth.inf_31bf3856ad364e35_6.0.6001.18064_none_ce26815f741bb5cd.manifest	Not Applicable	3,402	30-Apr-2008	00:04	Not Applicable
Amd64_bth.inf_31bf3856ad364e35_6.0.6001.22168_none_ceb41f528d35baf3.manifest	Not Applicable	3,402	30-Apr-2008	00:04	Not Applicable
Package_1_for_kb951376_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,941	29-Apr-2008	23:50	Not Applicable
Package_1_for_kb951376~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	2,674	29-Apr-2008	23:49	Not Applicable
Package_2_for_kb951376_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,781	29-Apr-2008	23:50	Not Applicable
Package_2_for_kb951376~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	2,510	29-Apr-2008	23:49	Not Applicable
Package_3_for_kb951376_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,781	29-Apr-2008	23:50	Not Applicable
Package_3_for_kb951376~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	2,510	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_client_0_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,423	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_client_0~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,442	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_client_1_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,365	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_client_1~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,384	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_client_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,699	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_client~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,732	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_server_0_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,423	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_server_0~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,442	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_server_bf~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,428	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_server~31bf3856ad364e35~amd64~~6.0.1.1.mum	Not Applicable	1,448	29-Apr-2008	23:49	Not Applicable
Update-bf.mum	Not Applicable	2,068	29-Apr-2008	23:50	Not Applicable
Bthenum.sys	6.0.6000.16682	23,040	29-Apr-2008	01:58	x64
Bthport.sys	6.0.6000.16682	276,480	29-Apr-2008	01:58	x64
Bthusb.sys	6.0.6000.16682	34,304	29-Apr-2008	01:58	x64
Fsquirt.exe	6.0.6000.16682	187,904	29-Apr-2008	04:00	x64
Bthenum.sys	6.0.6000.20824	23,040	29-Apr-2008	02:01	x64
Bthport.sys	6.0.6000.20824	276,480	29-Apr-2008	02:01	x64
Bthusb.sys	6.0.6000.20824	34,304	29-Apr-2008	02:01	x64
Fsquirt.exe	6.0.6000.20824	187,904	29-Apr-2008	02:01	x64
Bthenum.sys	6.0.6001.18000	23,040	19-Jan-2008	06:34	x64
Bthport.sys	6.0.6001.18064	276,480	29-Apr-2008	02:10	x64
Bthusb.sys	6.0.6001.18064	34,304	29-Apr-2008	02:10	x64
Fsquirt.exe	6.0.6001.18064	187,904	29-Apr-2008	04:16	x64
Bthenum.sys	6.0.6001.22168	23,040	29-Apr-2008	02:12	x64
Bthport.sys	6.0.6001.22168	276,480	29-Apr-2008	02:12	x64
Bthusb.sys	6.0.6001.22168	34,816	29-Apr-2008	02:12	x64
Fsquirt.exe	6.0.6001.22168	187,904	29-Apr-2008	02:12	x64

For all supported 32-bit editions of Windows Vista

File name	File version	File size	Date	Time	Platform
Package_1_for_kb951376_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,929	29-Apr-2008	23:50	Not Applicable
Package_1_for_kb951376~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	2,658	29-Apr-2008	23:49	Not Applicable
Package_2_for_kb951376_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,771	29-Apr-2008	23:50	Not Applicable
Package_2_for_kb951376~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	2,496	29-Apr-2008	23:49	Not Applicable
Package_3_for_kb951376_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,771	29-Apr-2008	23:50	Not Applicable
Package_3_for_kb951376~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	2,496	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_client_0_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,415	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_client_0~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,434	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_client_1_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,357	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_client_1~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,376	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_client_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,689	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_client~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,722	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_server_0_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,415	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_server_0~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,434	29-Apr-2008	23:49	Not Applicable
Package_for_kb951376_server_bf~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,420	29-Apr-2008	23:50	Not Applicable
Package_for_kb951376_server~31bf3856ad364e35~x86~~6.0.1.1.mum	Not Applicable	1,440	29-Apr-2008	23:49	Not Applicable
Update-bf.mum	Not Applicable	2,054	29-Apr-2008	23:50	Not Applicable
X86_bth.inf_31bf3856ad364e35_6.0.6000.16682_none_700a06c9bea9b8da.manifest	Not Applicable	3,400	30-Apr-2008	00:01	Not Applicable
X86_bth.inf_31bf3856ad364e35_6.0.6000.20824_none_70d68596d794e0d3.manifest	Not Applicable	3,400	30-Apr-2008	00:01	Not Applicable
X86_bth.inf_31bf3856ad364e35_6.0.6001.18064_none_7207e5dbbbbe4497.manifest	Not Applicable	3,400	30-Apr-2008	00:01	Not Applicable
X86_bth.inf_31bf3856ad364e35_6.0.6001.22168_none_729583ced4d849bd.manifest	Not Applicable	3,400	30-Apr-2008	00:01	Not Applicable
Bthenum.sys	6.0.6000.16682	19,456	29-Apr-2008	01:42	x86
Bthport.sys	6.0.6000.16682	220,160	29-Apr-2008	01:42	x86
Bthusb.sys	6.0.6000.16682	29,184	29-Apr-2008	01:42	x86
Fsquirt.exe	6.0.6000.16682	181,760	29-Apr-2008	03:50	x86
Bthenum.sys	6.0.6000.20824	19,456	29-Apr-2008	01:35	x86
Bthport.sys	6.0.6000.20824	220,160	29-Apr-2008	01:35	x86
Bthusb.sys	6.0.6000.20824	29,184	29-Apr-2008	01:35	x86
Fsquirt.exe	6.0.6000.20824	181,760	29-Apr-2008	01:35	x86
Bthenum.sys	6.0.6001.18000	19,456	19-Jan-2008	05:53	x86
Bthport.sys	6.0.6001.18064	220,160	29-Apr-2008	01:42	x86
Bthusb.sys	6.0.6001.18064	29,184	29-Apr-2008	01:42	x86
Fsquirt.exe	6.0.6001.18064	181,760	29-Apr-2008	03:54	x86
Bthenum.sys	6.0.6001.22168	19,456	29-Apr-2008	01:43	x86
Bthport.sys	6.0.6001.22168	220,160	29-Apr-2008	01:43	x86
Bthusb.sys	6.0.6001.22168	29,184	29-Apr-2008	01:43	x86
Fsquirt.exe	6.0.6001.22168	181,760	29-Apr-2008	01:43	x86

For all supported x64-based editions of Windows XP Professional

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Bthport.sys	5.2.3790.3122	320,512	09-May-2008	03:26	x64	SP1	SP1GDR
Bthport.sys	5.2.3790.3122	320,512	09-May-2008	03:26	x64	SP1	SP1QFE
Bthport.sys	5.2.3790.4274	320,512	09-May-2008	03:30	x64	SP2	SP2GDR
Bthport.sys	5.2.3790.4274	320,512	09-May-2008	03:26	x64	SP2	SP2QFE

For all supported 32-bit editions of Windows XP

File name	File version	File size	Date	Time	Platform	SP requirement	Service branch
Bthport.sys	5.1.2600.3389	272,128	13-Jun-2008	13:10	x86	SP2	SP2GDR
Bthport.sys	5.1.2600.3389	272,128	13-Jun-2008	09:52	x86	SP2	SP2QFE
Bthport.sys	5.1.2600.5620	272,128	13-Jun-2008	11:05	x86	SP3	SP3GDR
Bthport.sys	5.1.2600.5620	272,128	13-Jun-2008	11:27	x86	SP3	SP3QFE

Back to the top

On a Windows Vista-based client computer, you try to open a Microsoft Office document from a Web site hyperlink in a 2007 Microsoft Office application. When you do this, you may experience the following symptoms:

•	Performance is slow, or the 2007 Office application may stop responding for several minutes.
•	You are prompted for authentication even though you previously entered your credentials.
•	You lose session state. Then, you are redirected to a logon page or to an error page on the Web site.
•	The document is downloaded two times. When the files are large, the download process consumes more network bandwidth.

Note These problems do not occur when you try to open the document on a Windows XP-based computer or on a Windows Server 2003-based computer.

Back to the top

This problem occurs because, on a Windows Vista-based client computer, 2007 Office applications use the Windows WebDAV Mini-Redirector Client component to open URL-based files. This component provides read/write permissions to DAV-based Web servers that support Web authoring.

When you try to open a document from a hyperlink, 2007 Office applications may request that the Windows WebDAV Client try to author the document at the URL location. However, if the authoring attempt is not expected on certain Web servers or in certain situations, the symptoms that are mentioned in the Symptoms section may occur.

Back to the top

To resolve this problem, follow these steps.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

1.

Apply hotfix 954573. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base: 954573 (/Feedback.aspx?kbNumber=954573/) Description of the 2007 Office system hotfix package: June 26, 2008

2.

Enable the hotfix by configuring the UseWinINETCopy registry entry. To do this, follow these steps: a. Click Start, click Run, type regedit, and then click OK. b. Locate and then click the following registry subkey: HKEY_CURRENT_USER SOFTWARE Microsoft Office 12.0 Common Internet c. On the Edit menu, point to New, and then click DWORD Value. d. Type UseWinINETCopy, and then press ENTER. e. Right-click UseWinINETCopy, and then click Modify. f. In the Value data box, type 1, and then click OK. g. Exit Registry Editor.

Back to the top

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the Applies to section.

Back to the top

Microsoft has released security bulletin MS09-005. To view the complete security bulletin, visit one of the following Microsoft Web sites:

• Home users:
  http://www.microsoft.com/protect/computer/updates/bulletins/200902.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200902.mspx)

  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:

  http://update.microsoft.com/microsoftupdate/ (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/ms09-005.mspx (http://www.microsoft.com/technet/security/bulletin/ms09-005.mspx)

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

For enterprise customers, support for security updates is available through your usual support contacts.

Known issues and additional information about this security update

For more information about this security update and for information about any known issues with specific releases of this software, click the following article number to view the article in the Microsoft Knowledge Base:

The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Visio 2002

Visio 2003

Visio 2007

Source: Microsoft Support

Back to the top

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Back to the top

Rebooting of the server hosting the Microsoft.Clm.Service.exe service.

Back to the top

A timeout error happens, and the service does not autostart.

Back to the top

In some cases, this can be caused by the Authenticode check against the Certificate Revocation List (CRL) by the .NET Common Language Runtime (CLR).

Back to the top

There is a hotfix available to resolve this issue. 

/Feedback.aspx?kbNumber=936707 (/Feedback.aspx?kbNumber=936707)

Back to the top

In addition to the configuration information in the article, if the CRL lookup is happening in the CLM web application, we need to use the following instructions instead.

In the aspnet.config in the ASP .net installation folder, Add the tag: 

<configuration> <runtime> <generatePublisherEvidence enabled=false/> </runtime> </configuration>

Back to the top

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Back to the top

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Consider the following scenario:

·         You log in to a Windows 2008 Server using Remote Desktop.

·         You are using a roaming profile.

·         Icons are viewed as Large or Middle size icons (shortcut (.url)) on desktop.

·         You have changed an Icon image to be different than its default icon.

In this scenario when you use remote desktop you notice that the icon that is displayed for Internet shortcut files changes to the default system icon.

When you log in to Windows 2008 server by using Remote Desktop, Internet Explorer 7 has a limitation in that the .url handler for IExtractIcon will fail all requests for icons larger than 48×48, and if asked for a 48×48 icon, will return a default page icon.

Right click on desktop and choose Classic icons from view.

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

On Windows, every volume is assigned a unique volume name in the format  Volume {GUID} , where the GUID uniquely identifies that volume.  Under certain circumstances described in the More Information section, it is possible for a volume to be assigned multiple unique volume names and thus be assigned multiple GUIDs.  When this happens, the GetVolumeNameForVolumeMountPoint() Win32 API function will return one of the assigned names, but it may return a name which cannot be used.

This problem is caused by a bug in the GetVolumeNameForVolumeMountPoint Win32 API function on the products listed in the Applies to section of this article.  It occurs only for volumes that have been assigned multiple unique volume names (GUIDs).

The problem has been corrected in the following products:

• Windows Server 2008  — All versions
• Windows Vista Service Pack 1

 

Applications that must run on the affected products can work around this bug in one of two ways.  The first is to open the volume with the CreateFile Win32 function and then calling the DeviceIoControl function to issue the IOCTL_MOUNTMGR_QUERY_POINTS command. 

The second way is by calling GetVolumeNameForVolumeMountPoint twice.  In the first call, pass the target volume name as documented (usually as a the drive letter in the format X: ) in the lpszVolumeMountPoint parameter.  This call will return one of the assigned unique volume names in the lpszVolumeName parameter.  In the second call, pass the volume name returned by the first call in the lpszVolumeMountPoint parameter.  This will cause GetVolumeNameForVolumeMountPoint to return the expected volume name.

The sample below to see how you might call GetVolumeNameForVolumeMountPoint() twice to get the expected results. 

#include <windows.h>
#include <stdio.h>
#include <tchar.h>

int _tmain(int argc, TCHAR* argv[])
{

    TCHAR szGUID1 [MAX_PATH];
    TCHAR szGUID2 [MAX_PATH];

    if (argc != 2)
    {
        wprintf(L%s <x: > n n, argv[0]);
        return 0;
    }

    _tprintf(TEXT(Calling GetVolumeNameForVolumeMountPoint for %s n), argv[1]);

    // On the first call to GetVolumeNameForVolumeMountPoint
    // pass in whatever you would normally pass in
    if (GetVolumeNameForVolumeMountPoint(argv[1], szGUID1, MAX_PATH))
    {
        _tprintf(TEXT( GUID1: %s n n), szGUID1);
    }

    // On the second call, pass in the Volume Name received from the first
    // call to GetVolumeNameForVolumeMountPoint
    if (GetVolumeNameForVolumeMountPoint(szGUID1, szGUID2, MAX_PATH))
    {
        _tprintf(TEXT( GUID2: %s n n), szGUID2);
    }
    return 0;
}

CreateFile, DeviceIoControl, and IOCTL_MOUNTMGR_QUERY_POINTS are documented in the MSDN Library on http://msdn.microsoft.com (http://msdn.microsoft.com) .

A volume can be multiple unique volume names (and thus multiple GUIDs) when it is used by multiple running installations of Windows.  This could happen in the following scenarios and in similar scenarios where multiple installations of Windows have accessed the volume:

• Dual booting two or more copies of Windows which access the drive.
• Using a volume on a shared disk in a cluster where multiple nodes have accessed the volume.
• Moving the disk which hosts the volume from one computer to another.
• In a SAN environment where the volume was assigned to multiple instances of Windows.

In these situations, each running instance of Windows will assign its own GUID to the volume.  Furthermore, each instance will enumerate all of the volume names and mount points assigned to the volume and thus will see multiple GUIDs.  However, not all GUIDs may be used by the specific instance of Windows that is currently running.  This is why the volume name returned by GetVolumeNameForVolumeMountPoint may be incorrect.

The MOUNTVOL.EXE tool always returns the correct volume name.

 

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

This article describes the Web folders issues that are fixed in the Software Update for Web Folders that is dated May 18, 2007.

•	The issues that the update fixes.
•	The prerequisites for installing the update.
•	Whether you must restart the computer after you install the update.
•	Whether the update is replaced by any other update.
•	Whether you must make any registry changes.
•	The files that the update contains.

Back to the top

List of issues fixed

This update fixes various issues that may occur when you use Web folders from the client computer to connect to a server that supports Web Distributed Authoring and Versioning (WebDAV).

This update fixes the following issues:

•	A document that is opened from a Microsoft Office SharePoint Server 2007site may be downloaded two times when you click Edit in Microsoft Office program.
•	The download progress indicator does not work for some documents on the SharePoint site.
•	You cannot rename or copy files that have a display name in a non-Internet Information Services (IIS) Web folder.

Additionally, this update includes security enhancements to Web folders.

Back to the top

Update information

The following file is available for download from the Microsoft Download Center:
Download the Software Update for Web Folders package now. (http://www.microsoft.com/downloads/details.aspx?FamilyId=17C36612-632E-4C04-9382-987622ED1D64)

Release Date: May 18, 2007

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Restart information

You may have to restart the computer after you apply this update.

Update replacement information

This update replaces the Software Update for Web Folders that is dated January 25, 2005.

For more information about the Software Update for Web Folders that is dated January 25, 2005, click the following article number to view the article in the Microsoft Knowledge Base:

File information

After the update is installed, the English version of this update has the file attributes, or a later version of the file attributes, that are listed in the following table:

File name	File version	File size	Date	Time
Fp4autl.dll	4.0.2.3216	589,880	17-Nov-2004	22:33
Fp4awec.dll	4.0.2.2611	450,669	17-Nov-2004	22:33
Fpext_fp4.msg	Not Applicable	78,706	17-Nov-2004	22:33
Msdaipp.dll	12.0.4518.1014	1,011,488	27-Oct-2006	00:49
Msdapml.dll	12.0.4518.1014	163,104	27-Oct-2006	00:49
Msonsext.dll	12.0.4518.1014	970,528	27-Oct-2006	00:49
Nsextint.dll	12.0.4518.1014	75,552	27-Oct-2006	00:49

Additional notes

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

You update some page values in a Microsoft Office Word 2007 document. When you compare the revised document to the original document, the changes in the TOC and PageRef fields do not appear.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To resolve this issue, follow these steps:

1.

Install hotfix 954576.For more information, click the following article number to view the article in the Microsoft Knowledge Base: 954576 (/Feedback.aspx?kbNumber=954576/) Description of the Word 2007 hotfix package: June 20, 2008

2.

Set the CompDiffSupressPageRefOnlyInHdr registry entry. To do this, follow these steps: a. Click Start, click Run, type regedit, and then click OK. b. Locate and then click the following registry subkey: HKEY_CURRENT_USER Software Microsoft Office 12.0 Word Options c. On the Edit menu, point to New, and then click DWORD Value. d. Type CompDiffSupressPageRefOnlyInHdr, and then press ENTER. e. Right-click CompDiffSupressPageRefOnlyInHdr, and then click Modify. f. In the Value data box, type 1, and then click OK. g. Exit Registry Editor.

Source: Microsoft Support

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Windows writes Group Policy data to domain controller other than the one displayed.

Group Policy Administrators may target any domain controller regardless of the policy setting’s value.

The following scenarios may cause this problem:

·         Using GPMC to edit Group Policy objects over high-latency or transient network connections.

·         Incorrectly configured sites and subnets in Active Directory

 

There is no resolution at this time.

 

Best Practices:

·         Edit Group Policy object directly on the domain controller where you want to receive changes. (NOTE: this is not ideal for delegated environments).

·         Ensure the computer from which you edit Group Policy is in the same site as the domain controller where you want to receive changes.

·         Do not edit Group Policy over transient or high-latency connections. Use Remote Desktop or Terminal Services and connect to a computer located in the same site as the domain controller and edit or create Group Policy on that computer.

·         Do not leave Group Policy tools open for an extended period of time, most importantly when editing domain-based Group Policy objects.  Save changes as soon as possible.

 

User Interface behavior:

Group Policy Management Tools, at startup, attempt to locate and connect to the domain controller in the current domain that holds the Primary Domain Controller (PDC) emulator role. The “Group Policy domain controller selection” Group Policy setting enforces the initial connection to only use the domain controller defined in the policy setting. The policy setting does not prevent you from targeting another domain controller after you have loaded the Group Policy object in the appropriate editor.

 

Saving Policy Information:

Active Directory:

Group Policy editors save Group Policy object data to two locations: Active Directory and the system Volume (SYSVOL), which is hosted on all domain controllers within each domain. Group Policy editor use Directory Service Application Programming Interfaces (APIs) to locate the domain controllers. The domain controller returned by these API’s is displayed in the User Interface of the Group Policy Management tools. This is the server that receives Active Directory updates when you save a Group Policy object.

SYSVOL:

Each domain controller in the domain hosts a replicated copy of the System Volume. Group Policy stores most of the policy setting data on the sysvol, which then replicates to each domain controller.  Group Policy editors save Group Policy data to a serverless path ( domainname.com sysvol policies [guidfolder]).  Each domain supports this special named path through Distributed File System (DFS) redirection.   The actual path domainname.com sysvol  does not physically exist. The network redirector considers this a special named path and creates a list of domain controllers that host sysvol.  Entries in this list are known as link targets and included server names in the path ( servername sysvol).  This list is ordered differently on each client based on site configurations in Active Directory, thereby ensuring computers connecting to this path connect to the closest domain controller hosting this path.  The redirector reviews this list when a connection to domainnanme.com sysvol  is requested.  The redirector chooses a link target form this list, ensures the link target is responsive, and redirect the connection domainname.com sysvol to the path included in the link target, which includes a server name. This link then becomes the active link target for domainname.com sysvol.  If the active link path is unavailable, the computer consults the list again and chooses the next link target in the list, ensures it is responsive, and makes it the active link target for domainname.com sysvol.

Saving to Sysvol:

Domain Controllers are the only servers that host Sysvol. Therefore, the domain controller returned from the Active Directory API, in theory, should be included in the list of link targets. The Group Policy API attempts to prioritize this server as the active link target; attempting to ensure saving Group Policy data to Sysvol occurs on the same domain controller that received the saved Active Directory data.  However, it is possible the name of the domain controller returned from Active Directory is not in the link target list or that the link target may change when editing a Group Policy object.

This change is normal as domainname.com sysvol is purposefully dynamic to ensure the path always resolves to working location. Then nature of redirecting sysvol allows Group Policy to save SYSVOL information to domain controller that is not listed in the Group Policy Management UI. This also prevents the “Group Policy domain controller selection” policy setting from being absolute.

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.