The following are the suggested operations for this VSS warning.

Operation:

•	Check whether the volume is supported by a provider.
•	Add a volume to a shadow copy set.

Context:

Execution Context: Provider   Provider Name: <provider name>   Provider Version: 1.0   Provider ID: {b57190af-454a-4dd0-8afd-e57facd5d9af}   Volume Name:   ? Volume{5b1ced58-7dd1-11dc-b4df-00065ba14874}    Snapshot Context: 25   Execution Context: Coordinator   Provider ID: {00000000-0000-0000-0000-000000000000}   Volume Name:   ? Volume{5b1ced58-7dd1-11dc-b4df-00065ba14874}    Execution Context: Coordinator

Friendly view of the event data:

- System  - Provider   [ Name]  VSS  - EventID 12333   [ Qualifiers]  0   Level 3   Task 0   Keywords 0x80000000000000  - TimeCreated   [ SystemTime]  <time>   EventRecordID 279   Channel Application   Computer <computer name>   Security- EventData   1   1   60   0   1

Binary data:

In Words0000: 6F43202D 203A6564 48524F43 435455570008: 30303030 38303331 6143202D 203A6C6C0010: 48524F43 43545557 30303030 353332310018: 4950202D 20203A44 30303030 303230310020: 4954202D 20203A44 30303030 323931320028: 4D43202D 20203A44 575C3A43 6F646E690030: 735C7377 65747379 5C32336D 767373760038: 78652E63 20202065 7355202D 203A72650040: 4120544E 4F485455 59544952 5359535C0048: 204D4554 20202020 6953202D 20203A640050: 2D312D53 38312D35In Bytes0000: 2D 20 43 6F 64 65 3A 20   - Code:0008: 43 4F 52 48 57 55 54 43   CORHWUTC0010: 30 30 30 30 31 33 30 38   000013080018: 2D 20 43 61 6C 6C 3A 20   - Call:0020: 43 4F 52 48 57 55 54 43   CORHWUTC0028: 30 30 30 30 31 32 33 35   000012350030: 2D 20 50 49 44 3A 20 20   - PID:0038: 30 30 30 30 31 30 32 30   000010200040: 2D 20 54 49 44 3A 20 20   - TID:0048: 30 30 30 30 32 31 39 32   000021920050: 2D 20 43 4D 44 3A 20 20   - CMD:0058: 43 3A 5C 57 69 6E 64 6F   C: Windo0060: 77 73 5C 73 79 73 74 65   ws syste0068: 6D 33 32 5C 76 73 73 76   m32 vssv0070: 63 2E 65 78 65 20 20 20   c.exe0078: 2D 20 55 73 65 72 3A 20   - User:0080: 4E 54 20 41 55 54 48 4F   NT AUTHO0088: 52 49 54 59 5C 53 59 53   RITY SYS0090: 54 45 4D 20 20 20 20 20   TEM0098: 2D 20 53 69 64 3A 20 20   - Sid:00a0: 53 2D 31 2D 35 2D 31 38   S-1-5-18

This problem may occur only occasionally.

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista, 64-bit versions

Back to the top

Back to the top

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Back to the top

Back to the top

You cannot work around this issue if you have an upgrade version of Windows Vista.

Back to the top

Back to the top

These symptoms occur if the following conditions are true:

•	You are using a touch screen device on a Windows Vista-based computer.
•	The touch screen device is set to use a digitizer.
•	The Stylus and Touch input program was written by using the Windows Presentation Foundation (WPF) Host. The input program is hosted in Windows Media Center or in Internet Explorer.

These problems do not occur if you use a mouse instead of a stylus to input ink.

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista, x64-based version

Back to the top

Back to the top

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

You may experience this issue if the following conditions are true:

•	The driver uses an executable file-based installation program.
•	The installation program was not designed for Windows Vista.

Back to the top

Back to the top

Important Before you use one of these methods, we recommend that you contact the device manufacturer or the driver manufacturer for more information about how to install the driver in Windows Vista.

Back to the top

To run the driver installation program in compatibility mode

Configure the driver installation program to run in Microsoft Windows XP Service Pack 2 compatibility mode. To do this, follow these steps:

1.	Locate the executable file for the driver installation program.
2.	Right-click the file, and then click Properties.
3.	In the PackageName Properties dialog box, click the Compatibility tab.
4.	Click to select the Run this program in compatibility mode for check box, click Windows XP (Service Pack 2) in the Run this program in compatibility mode for list, and then click OK.
5.	Double-click the executable file to start the installation program.

Back to the top

To run the driver installation program by using administrative credentials

Configure the driver installation program to run in the context of the Administrator account. To do this, follow these steps:

1.	Locate the executable file for the driver installation program.
2.	Right-click the file, and then click Run as administrator. If you are prompted for an administrator password or confirmation, type your password or click Continue.
3.	Follow the steps to install the driver.

Back to the top

To locate the .inf file and manually install the driver

Use Device Manager to install the driver. To do this, follow these steps.

Step 1: Locate the .inf file

Locate the .inf file that is included with the driver installation program. Generally, the .inf file is located in one of the following folders on the driver installation media:

•	In the same folder as the Setup program.
•	In a subfolder that is in the folder that contains the Setup program. Generally, the subfolder has a name such as Windows XP, Drivers, or WinXP.

If the driver files are packaged in a single executable file, you may be able to extract them or otherwise access them. To do this, use one of the following methods, as appropriate for your situation:

•	Use a file compression program to extract the files. If the driver files are packaged in a single executable file, you may be able to use a file compression tool such as WinZip or WinRAR to extract the contents of the driver package to a folder. The .inf file should be among the files that you extract.
•	Use the Windows Compressed Folders feature to extract the files. If you do not have the WinZip program or the WinRAR program, you may be able to extract the files by using the Windows Compressed Folders feature. To do this, change the file name extension from .exe to .zip. Then, use Windows Explorer to copy the files from the compressed folder.
•	Extract the contents from the .cab file. If there is no .inf file in the driver package, but there are one or more .cab files, you may be able to extract the contents of the .cab files. Note This method is usually unsuccessful. Typically, these kinds of driver packages are created by using the InstallShield program. The InstallShield program uses a special .cab format that is not designed to be accessed by tools such as WinZip or WinRAR.
•	Locate the files in the Temp folder. If you still cannot access the installation files, try to locate extracted temporary files. Typically, files are extracted to a local Temp folder when you install a program. You may be able to view the contents of the driver package by examining the contents of the Temp folder. To do this, follow these steps: 1. Remove the contents of the Temp folder. By removing the contents of the Temp folder, you can more easily locate the temporary files that are created when you run the driver installation program. To remove the contents of the Temp folder, follow these steps: a. Click Start, and then click Computer. b. Right-click the hard disk on which Windows Vista is installed, and then click Properties. c. In the Local Disk (DriveLetter) Properties dialog box, click the General tab, and then click Disk Cleanup. d. In the Disk Cleanup Options dialog box, click Files from all users on this computer. If you are prompted for an administrator password or confirmation, type your password or click Continue. e. Under Files to delete, click to clear all the check boxes, click to select the Temporary files check box, and then click OK. f. When you are prompted to permanently delete the files, click Delete Files. 2. Use Windows Explorer to open the Temp folder. To do this, click Start, type %temp% in the Start Search box, and then press ENTER. 3. Start the driver installation program. Note Some installation programs automatically delete the temporary files when the installation program exits. Therefore, leave the driver installation program running in the background. 4. Examine the contents of the Temp folder to locate the driver files.

Step 2: Manually install the driver

After you locate the .inf file for the driver that you want to install, manually install the new driver. To do this, follow these steps:

1.	Click Start, right-click Computer, and then click Properties.
2.	In the Tasks pane, click Device Manager. If you are prompted for an administrator password or confirmation, type your password or click Continue.
3.	In Device Manager, locate the device for which you want to install the driver. Note To display hidden devices, click Show hidden devices on the View menu.
4.	Right-click the device, and then click Update Driver Software.
5.	Click Browse my computer for driver software, click Let me pick from a list of device drivers on my computer, and then click Have Disk.
6.	In the Install From Disk dialog box, click Browse, locate an .inf file for the device driver that you want to install, and then click Open.
7.	Follow the steps in the Update Driver Software DeviceName dialog box to update the driver.

The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Back to the top

Note In this command, dsa represents the host name of a domain controller. Also, NamingContext represents the distinguished name of the directory partition.

However, a Windows Server 2008-based read-only domain controller (RODC) will not try to pull the changes for the specified naming context.

Note The Windows Server 2008-based RODC holds the changes for the specified naming context in its read-only global catalog partition.

To confirm this behavior, you can run the repadmin /showreps command on an RODC. You may notice that the time stamp of the last successful replication of the specified partition was left unchanged. If you run the same command on a full domain controller that is running either Windows Server 2003 or Windows Server 2008, you see that the time stamp of last successful replication for the specified partition is up to date.

Back to the top

RODCs store the hasPartialReplicaNCs attribute locally. When the repadmin /syncall command is executed from a full domain controller, the full domain controller does not have information about the RODC. Therefore, no replication to the RODC is triggered.

Back to the top

Note The /P parameter is not a repadmin option on a read-only global catalog. This is the case because, by definition, the read-only global catalogs cannot have originating updates to replicate to other domain controllers.

Note To access advanced help for the Repadmin.exe tool, use the /experthelp parameter.

Back to the top

Back to the top

The following is the output of the Repadmin /showattr command when the command is run against all the domain controllers. You will notice that the hasPartialReplicaNCs attribute is only returned when Repadmin /showattr is queried against the RODC.

Domain Information:Parent Domain:  DC1-2003 Domain Controller                            2008-01 2008 Domain ControllerSub-Domain:  2008-02 - Windows server 2008 Domain Controller 2008-03 - Windows Server 2008 Domain Controller.C: Users Administrator.SUB>repadmin /showattr * CN=NTDS Settings,CN=2008-03,CN=Servers,CN=Asia,CN=Sites,CN=Configuration,DC=contoso,DC=com /atts:hasPartialReplicaNCsRepadmin: running command /showattr against full DC dc1.contoso.comDN: CN=NTDS Settings,CN=2008-03,CN=Servers,CN=Asia,CN=Sites,CN=Configuration,DC=contoso,DC=comRepadmin: running command /showattr against full DC 2008-02.sub.contoso.comDN: CN=NTDS Settings,CN=2008-03,CN=Servers,CN=Asia,CN=Sites,CN=Configuration,DC=contoso,DC=comRepadmin: running command /showattr against full DC 2008-01.contoso.comDN: CN=NTDS Settings,CN=2008-03,CN=Servers,CN=Asia,CN=Sites,CN=Configuration,DC=contoso,DC=comRepadmin: running command /showattr against read-only DC 2008-03.sub.contoso.comDN: CN=NTDS Settings,CN=2008-03,CN=Servers,CN=Asia,CN=Sites,CN=Configuration,DC=contoso,DC=com    1> hasPartialReplicaNCs: DC=contoso,DC=com

Back to the top

This diagnostic report that is generated by this tool is derived from the system logs that are collected by the tool during its analysis phase. Therefore, this report is conclusive. The information in these logs is sufficient to diagnose any network-related issues. For assisted support, you may have to share the logs with network administrators or with Microsoft Support. For more assistance, see the Help feature that is included with the tool.

To download the Microsoft IPsec Diagnostic Tool, visit the following Microsoft Download Center Web site:
The following file is available for download from the Microsoft Download Center:
Download the Microsoft IPSec Diagnostic Tool – 1.0.msi package now. (http://www.microsoft.com/downloads/details.aspx?FamilyID=1d4c292c-7998-42e4-8786-789c7b457881&DisplayLang=en)Release Date: January 30, 2008

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

In this scenario, the application does not start if the length of the combined paths of the files exceeds 160 characters (MAX_PATH).

Back to the top

Back to the top

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, 32-bit versions

Windows Vista, 64-bit versions

Windows Vista, Itanium-based versions

Back to the top

Back to the top

This problem affects both Microsoft Office Outlook Web Access Premium and Microsoft Office Outlook Web Access Light. Windows Internet Explorer 7 and later versions of Internet Explorer are the only versions of Internet Explorer that support the S/MIME control.

Note This problem occurs only if the following conditions are true:

•	The e-mail messages are sent within a Microsoft Exchange Server organization.
•	The e-mail messages are sent from Microsoft Exchange 2000 Server or from Microsoft Exchange Server 2003 to Exchange Server 2007.
•	The e-mail messages are in an Exchange Server 2007 mailbox.

Back to the top

Back to the top

Back to the top

If you forward the e-mail message in Outlook or if you perform any other operation that promotes the clear signed content to the relevant MAPI properties of the clear signed message, the body of the e-mail message is visible in Outlook Web Access.

For more information about clear signed messages, visit the following Web sites:

For more information about S/MIME, visit the following Web site:

Back to the top

To register the Hyper-V VSS writer with Windows Server Backup, follow these steps:

1. Click Start, click Run, type regedit, and then click OK.
2. Locate the following registry key:
   HKEY_LOCAL_MACHINE SOFTWARE Microsoft Windows NT CurrentVersion
3. Right-click CurrentVersion, point to New, and then click Key.
4. Type WindowsServerBackup, and then press ENTER.
5. Right-click WindowsServerBackup, point to New, and then click Key.
6. Type Application Support, and then press ENTER.
7. Right-click Application Support, point to New, and then click Key.
8. Type {66841CD4-6DED-4F4B-8F17-FD23F8DDC3DE}, and then press ENTER.
9. Right-click {66841CD4-6DED-4F4B-8F17-FD23F8DDC3DE}, point to New, and then click String Value.
10. Type Application Identifier, and then press ENTER.
11. Right-click Application Identifier, and then click Modify.
12. In the Value data box, type Hyper-V, and then click OK.
13. On the File menu, click Exit.

Back to the top

More information about Hyper-V virtual machine backups

Back up the virtual machines by using Windows Server Backup

• When you perform a backup of the virtual machines, you must back up all volumes that host files for the virtual machine.For example, if the virtual machine configuration files are stored on the D: volume, and the virtual machine virtual hard disk (VHD) files are stored on the E: volume, you must back up both the D: and E: volumes.
• Virtual machines that do not have Integration Services installed will be put in a saved state while the VSS snapshot is created.
• Virtual machines that are running operating systems that do not support VSS, such as Microsoft Windows 2000 or Windows XP, will be put in a saved state while the VSS snapshot is created.
• Virtual machines that contain dynamic disks must be backed up offline.

Restore virtual machines by using Windows Server Backup

To restore the virtual machines, follow these steps:

1. Start Windows Server Backup in Administrative Tools.
2. On the Actions menu, click Recover.
3. Select the server that you want to recover data from, and then click Next.
4. Select the date and time that you want to restore from, and then click Next.
5. Select the Applications recovery type, and then click Next.
6. Select Hyper-V, and then click Next.
7. Select the restore location, and then click Next.
8. Click Recover to start the restore process.

Note All volumes that host files for the virtual machine will be restored. Individual virtual machines cannot be restored by using Windows Server Backup.

Virtual machines that contain two or more snapshots will not be restored. To work around this issue, follow these steps:

1. Start Hyper-V Manager in Administrative Tools.
2. Delete the virtual machine that was not restored.
3. Start Windows Server Backup in Administrative Tools.
4. On the Actions menu, click Recover.
5. Select the server that you want to recover data from, and then click Next.
6. Select the date and time that you want to restore from, and then click Next.
7. Select the Files and folders recovery type, and then click Next.
8. Select the directory where the snapshots are stored, and then click Next.

   Note By default, the snapshots are located in the following directory:

   C: ProgramData Microsoft Windows Hyper-V Snapshots
9. Select the location where the snapshots should be restored, and then click Next.
10. Click Recover to start the restore process.
11. After the restore has finished, perform another restore. However, use the Applications recovery type, and select Hyper-V to correctly restore the virtual machines.

Back to the top

• You are running a Windows Server 2008-based computer that is connected to a storage device over some Microsoft Multipath I/O (MPIO) paths.
• A Microsoft MPIO Device Specific Module is enabled for these MPIO paths.
• The storage device is configured as an iSCSI boot device or a Storage Area Network (SAN) boot device.
• You have installed hotfix 957316 on the Windows Server 2008-based computer.

In this scenario, the computer restarts repeatedly, or you may receive a Stop error message, depending on the actual failure recovery options.

Note For more information about hotfix 957316, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Hotfix information

Important Windows Vista and Windows Server 2008 hotfixes are included in the same packages. However, only one of these products may be listed on the “Hotfix Request” page. To request the hotfix package that applies to both Windows Vista and Windows Server 2008, just select the product that is listed on the page.

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into Windows Server 2008.
• The .manifest files and the .mum files that are installed in each environment are listed separately in the Additional file information for Windows Server 2008 and for Windows Vista section. These files and their associated .cat (security catalog) files are critical to maintaining the state of the updated component. The .cat files are signed with a Microsoft digital signature. The attributes of these security files are not listed.

For all supported x86-based versions of Windows Server 2008

For all supported x64-based versions of Windows Server 2008

For all supported Itanium-based versions of Windows Server 2008

Back to the top

Additional file information for Windows Server 2008

Additional files for all supported x86-based versions of Windows Server 2008

Additional files for all supported x64-based versions of Windows Server 2008

Additional files for all supported Itanium-based versions of Windows Server 2008

Back to the top

Additionally, if the disk is formatted by using the NTFS file system, a Warning event that resembles the following may be logged in the System log:

This issue may occur if the disk is surprise removed.For example, this behavior may occur if you remove the disk without using the Safely Remove Hardware icon in the notification area to stop the disk first. This issue may occur even though the disk uses an interface that supports surprise removal, such as a universal serial bus (USB) interface or an IEEE 1394 interface.

Back to the top

Note If your configuration requires that you frequently surprise-remove the disk, we recommend that you do not enable System cache mode. For more information about System cache mode, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

The FAT32 file system does not use this method of transaction logging. Therefore, event ID 57 is not logged when a FAT32 drive is surprise-removed.

Warning Regardless of the file system that is used on a drive, data corruption may occur if you disconnect the drive during a write operation.

For more information about the NTFS file system, visit the following Microsoft Web site:

Back to the top

This problem occurs if the security package is signed by using the method that is described on the following Microsoft Developer Network Web site:

Note The security package that causes this problem may be offered by a third-party cryptographic service provider. A security package is a software implementation of a security protocol.

Back to the top

If this problem has already occurred, you must run a repair installation of Windows Vista.

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista, 64-bit versions

Back to the top

Back to the top

Back to the top

In this Windows Vista Support WebCast, columnist Joli Ballew shares her excitement about Windows Vista. She details the coolest new features, the ease of use, and shares what early adopters are saying about the newest Microsoft operating system.

This is a Level 100 (http://support.microsoft.com/default.aspx?scid=gp;en-us;webcastlevels&sd=gn) session presented by Joli Ballew .

Joli Ballew is the author of almost 20 books. These books include Microsoft Windows XP: Do Amazing Things (Microsoft Press, 2003) (http://www.microsoft.com/mspress/books/6848.aspx). You can visit Joli’s newly designed Web site at http://www.joliballew.com (http://www.joliballew.com). You can also contact Joli at joli_ballew@comcast.net (mailto:joli_ballew@comcast.net).

Viewing the Presentation

To view, click this link: View this On-demand Recording (https://www118.livemeeting.com/cc/msevents/view?id=WV012907) (Length: 1 hour 13 minutes)

Offline viewing download (http://download.microsoft.com/download/8/5/3/8535cb71-6c90-4375-87fb-8908d692cb70/wv012907.wmv.zip)- If you wish to download a copy of this broadcast to your local hard drive for off-line viewing, we provide this as a separate file (.zip archive) that you can download.

Podcasting/Mobile Resources

Audio-Only Stream (.WMA format) (http://download.microsoft.com/download/8/5/3/8535cb71-6c90-4375-87fb-8908d692cb70/wv012907.wma.zip) – Click this link if you wish to listen to an audio-only version of this broadcast in WMA (Windows Media Audio) streaming format.

Audio-Only Stream (.MP3 format) (http://download.microsoft.com/download/8/5/3/8535cb71-6c90-4375-87fb-8908d692cb70/wv012907.mp3.zip) – Click this link if you wish to listen to an audio-only version of this broadcast in MP3 (MPEG Audio) format.
Additional Resources

Download the presentation (http://download.microsoft.com/download/8/5/3/8535cb71-6c90-4375-87fb-8908d692cb70/wv012907.zip) – This is a Microsoft PowerPoint (.ppt) file.
If you do not have PowerPoint and you want a copy of the slides, use the PowerPoint Viewer (http://www.microsoft.com/downloads/details.aspx?FamilyID=428d5727-43ab-4f24-90b7-a94784af71a4&DisplayLang=en) (1,911 KB).

Read the transcript from this event (http://download.microsoft.com/download/8/5/3/8535cb71-6c90-4375-87fb-8908d692cb70/wvt012907.zip)

Provide Feedback on this Broadcast (http://support.microsoft.com/common/survey.aspx?scid=sw;en;1326&p0=XX&p1=en-us&p2=012907)

Support WebCasts Home (http://support.microsoft.com/webcasts)

Note If the application does not capture the exception that is returned by CDao on the insertion or the update, the database will not have the updates that you intended to make.

Back to the top

Back to the top

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Back to the top

Back to the top

• The issues that the hotfix package fixes.
• The prerequisites for installing the hotfix package.
• Whether you must restart the computer after you install the hotfix package.
• Whether the hotfix package is replaced by any other hotfix packages.
• Whether you must make any registry changes.
• The files that the hotfix package contains.

Back to the top

Issues that this hotfix package fixes

This hotfix fixes the following issues that are not previously documented in a Microsoft Knowledge Base article:

• Consider the following scenario:
  • You publish a SharePoint Portal Server 2007 publishing portal site through Microsoft Internet Security and Acceleration (ISA) Server 2006.
  • The Web application that hosts the publishing portal site is configured to use Allow Anonymous Access and Windows Authentication (NTLM).
  • Output caching is enabled on the publishing portal site through ISA Server 2006, but output caching fails.

  If you press F5 in Internet Explorer to refresh the Web page, the date on the output page is updated. The date should remain constant for the period of time in which the cache is not invalidated. To see the date on the output page in Internet Explorer, right-click the Web page, click View Source, and search for the code that resembles the following:

  Rendered using cache profile:Public Internet (Purely Anonymous) at: 2008-10-10T12:00:57
• You add the Scheduling Start Date field and the Scheduling End Date field to a Web page. You try to publish a page with Immediately option, you may receive the following error message:
  You must specify a valid date within the range of xxx and xxx.
• When you review a document library through Site Content and Structure, filtering does not work when the column value contains a semicolon (;).
• If you configure the Max. Cache Size setting of the Site collection object cache to more than 2000, an integer overflow exception may occur. You may receive an error message that resembles the following:
  Unable to display this Web Part. To troubleshoot the problem, open this Web page in a Windows SharePoint Services-compatible HTML editor such as Microsoft Office SharePoint Designer. If the problem persists, contact your Web server administrator.
• Non-core search Web part queries are not recorded into usage logs.
• You add the Scheduling Start Date field and the Scheduling End Date field to a Web page. You set the values for the Scheduling Start Date field and the Scheduling End Date field, and then you wait until the Web page expires. When you try to publish the Web page, you may receive the following error message:
  The end date of a page must be in the future. Please edit the end date and try again.
• Incremental crawls fail to be scheduled when you have multiple Shared Services Providers (SSPs), and one SSP contains many sources.
• You use the Team Site template as the template for the Top-level site in Office SharePoint Server 2007. A subsite owner of the top-level site does not have access permissions to the top-level site. When the subsite owner tries to create his own subsite, the owner may receive an Access Denied error message.
• You may receive an ELEMENT NOT FOUND (COM-INTEROP): exception when you are running crawls that overlap. This issue causes the crawls to fail, and SharePoint server does not index any further documents.
• When you click the Local Office SharePoint Server Sites link in Content Sources, you may receive the following error message:
  Unexpected Error has occurred
• Search returns zero results during an index merge process.

This hotfix fixes the following issues:

• 959122  (/Feedback.aspx?kbNumber=959122/ ) Users cannot create a new variation of a page that they created in a Microsoft Office SharePoint Server 2007 site
• 960254  (/Feedback.aspx?kbNumber=960254/ ) Error message when you click Checked out to me in the Manage Content and Structure page after you filter the picture library by a custom column: Cannot find column [repro]

Back to the top

Known issue

Symptoms

After you apply this Cumulative Update, scheduled incremental crawls or full crawls never run.

Workaround

Create a new daily, weekly, or monthly schedule. Or, edit an existing daily, weekly, or monthly schedule.

• If the Repeat within the day check box is checked, and you already have a repetition interval, you do not have to do anything
• If the Repeat within the day check box is not checked, enter 5 minutes in the Run Every text box. Additionally, enter 6 minutes in the For text box.

Back to the top

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problems that are described in this article. Apply this hotfix only to systems that are experiencing the problems described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

There are no prerequisites for installing this hotfix.

Restart requirement

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace a previously released hotfix.

Registry information

To use one of the hotfixes in this package, you do not have to make any changes to the registry.

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article.

The global version of this hotfix package uses a Microsoft Windows Installer package to install the hotfix package. The dates and the times for these files are listed in Coordinated Universal Time (UTC) in the following table. When you view the file information, the date is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

32-bit hotfix package

Download information

Microsoft Windows Installer .msp file information

After the hotfix is installed, the global version of this hotfix has the file attributes, or a later version of the file attributes, that are listed in the following table:

64-bit hotfix package

Download information

Microsoft Windows Installer .msp file information

After the hotfix is installed, the global version of this hotfix has the file attributes, or a later version of the file attributes, that are listed in the following table:

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top

For example, the following DiskConfiguration section of the Unattend.xml file creates partitions on a disk, and then assigns drive letter C to the first partition:

<DiskConfiguration>  <Disk>    <DiskID>0</DiskID>    <CreatePartitions>      <!—Create Partition 1-->      <CreatePartition>        <Order>1</Order>        <Type>Primary</Type>        <Size>100</Size>      </CreatePartition>           <!—Create Partition 2-->      <CreatePartition>        <Order>2</Order>        <Type>Primary</Type>        <Extend>true</Extend>      </CreatePartition>    </CreatePartitions>    <ModifyPartitions>      <!—Assign Drive Letter C to Partition 1-->      <ModifyPartition>        <Order>1</Order>        <PartitionID>1</PartitionID>        <Letter>C</Letter>      </ModifyPartition>    <ModifyPartitions></Disk>   </DiskConfiguration>

Then, in the following ImageInstall section of the Unattended.xml file, you specify that Windows Vista is installed on Partition 2:

<ImageInstall>    <OSImage>      <InstallTo>        <DiskID>0</DiskID>        <PartitionID>2</PartitionID>      </InstallTo>    </OSImage>  </ImageInstall>

You expect the following results:

•	Partition 1 is assigned drive letter C.
•	Partition 2 is either assigned drive letter D or the next available drive letter.

The actual results are as follows:

•	Partition 1 is either assigned drive letter D or the next available drive letter.
•	Partition 2 is assigned drive letter C.

Back to the top

<ModifyPartition>        <Order>2</Order>        <PartitionID>2</PartitionID>        <Letter>D</Letter>      </ModifyPartition>

Back to the top

In this scenario, the Play and AutoPlay items do not appear on the shortcut menu that the application retrieves.

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

To apply this hotfix, you must have Windows Vista Service Pack 1 installed. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista with Service Pack 1, x86-based versions

Windows Vista with Service Pack 1, x64-based versions

Windows Vista with Service Pack 1, Itanium-based versions

Back to the top

Back to the top

Back to the top

Back to the top

Suite B is used as an interoperable cryptographic framework for protecting sensitive data. Support has been extended to the Suite B algorithms for the following areas:

•	Main mode
•	Quick mode
•	Authentication settings

This article also describes the Internet Protocol security (IPsec) policy configuration syntax that uses Suite B algorithms.

Back to the top

Support limitations

Support limitations for Suite B include the following:

•	The authoring of policies that contain Suite B algorithms is not supported in the Windows Firewall with Advanced Security Microsoft Management Console (MMC) snap-in.
•	The Netsh advfirewall help command does not display configuration options for Suite B algorithms.
•	The creation and enforcement of IPsec policy by using Suite B algorithms is supported only in Windows Vista Service Pack 1 (SP1), in Windows Server 2008, or in later versions of Windows.

Back to the top

Definitions

Back to the top

Main-mode algorithms

In Windows Vista SP1 and in Windows Server 2008, the following integrity algorithms are supported in addition to those algorithms that are already supported in the release version of Windows Vista:

•	SHA-256
•	SHA-384

Note The key exchange algorithm and the encryption algorithm are not changed.

Back to the top

Quick-mode algorithms

In Windows Vista SP1 and in Windows Server 2008, the following algorithms are supported in addition to those algorithms that are already supported in the release version of Windows Vista.

Integrity (AH or ESP)

Integrity and encryption (ESP only)

For more information about AH and ESP combinations that are supported and not supported, see the Quick-mode cryptographic algorithm combinations that are supported and not supported section.

Restrictions for Quick mode

Back to the top

Authentication

In Windows Vista SP1 and in Windows Server 2008, the following authentication methods are supported in addition to those authentication methods that are already supported in the release version of Windows Vista.

•	Computer certificate with ECDSA-P256 signing
•	Computer certificate with ECDSA-P384 signing

Note The default authentication method for Windows Vista is RSA SecurId authentication.

Back to the top

Syntax and examples

This section describes the syntax for using the Netsh advfirewall command to add and to modify connection security rules. This section also provides examples of Netsh advfirewall commands.

Add a connection security rule

Netsh advfirewallUsage: add rule name=<string>      endpoint1=any|localsubnet|dns|dhcp|wins|defaultgateway|         <IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>      endpoint2=any|localsubnet|dns|dhcp|wins|defaultgateway|         <IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>      action=requireinrequestout|requestinrequestout|         requireinrequireout|noauthentication      [description=<string>]      [mode=transport|tunnel (default=transport)]      [enable=yes|no (default=yes)]      [profile=public|private|domain|any[,...] (default=any)]      [type=dynamic|static (default=static)]      [localtunnelendpoint=<IPv4 address>|<IPv6 address>]      [remotetunnelendpoint=<IPv4 address>|<IPv6 address>]      [port1=0-65535|any (default=any)]      [port2=0-65535|any (default=any)]      [protocol=0-255|tcp|udp|icmpv4|icmpv6|any (default=any)]      [interfacetype=wiresless|lan|ras|any (default=any)]      [auth1=computerkerb|computercert|computercertecdsap256|computercertecdsap384|computerpsk|         computerntlm|anonymous[,...]]      [auth1psk=<string>]      [auth1ca=<CA Name> [certmapping:yes|no] [excludecaname:yes|no] ...]      [auth1healthcert=yes|no (default=no)]      [auth1ecdsap256ca=<CA Name> [certmapping:yes|no] [excludecaname:yes|no] ...]      [auth1ecdsap256healthcert=yes|no (default=no)]      [auth1ecdsap384ca=<CA Name> [certmapping:yes|no] [excludecaname:yes|no] ...]      [auth1ecdsap384healthcert=yes|no (default=no)]      [auth2=computercert| computercertecdsap256|computercertecdsap384|userkerb|usercert| usercertecdsap256|usercertecdsap384|userntlm|anonymous[,...]]      [auth2ca=<CA Name> [certmapping:yes|no] ...]      [auth2ecdsap256ca=<CA Name> [certmapping:yes|no] ...]      [auth2ecdsap384ca=<CA Name> [certmapping:yes|no] ...]      [qmpfs=dhgroup1|dhgroup2|dhgroup14|ecdhp256|ecdhp384|mainmode|         none (default=none)]      [qmsecmethods=         ah:<integrity>+esp:<integrity>-<encryption>+[valuemin]+[valuekb]         |default]        Remarks:      - The rule name should be unique, and it cannot be all.      - When mode=tunnel, both tunnel endpoints must be specified and must be        the same IP version. Also, the action must be requireinrequireout.      - At least one authentication must be specified.      - Auth1 and auth2 can be comma-separated lists of options.      - The computerpsk and computerntlm methods cannot be specified together        for auth1.      - Computercert cannot be specified with user credentials for auth2.     - Certsigning options ecdsap256 and ecdsap384 are supported only on Windows Vista SP1 and on later versions of Windows Vista.      - Qmsecmethods can be a list of proposals separated by a comma (,).      - For qmsecmethods, integrity=md5|sha1|sha256| aesgmac128|aesgmac192|aesgmac256|aesgcm128|aesgcm192|aesgcm256 and        encryption=3des|des|aes128|aes192|aes256|aesgcm128|aesgcm192|aesgcm256.      - If aesgcm128, aesgcm192, or aesgcm256 is specified, it must be used for both ESP integrity and encryption.       -  sha-256, aesgmac128, aesgmac192, aesgmac256, aesgcm128, aesgcm192, aesgcm256 are supported only on Windows Vista SP1 and on later versions of Windows Vista.       - Qmpfs=mainmode uses the main mode key exchange setting for PFS.      - We recommend that you do not use DES, MD5, or DHGroup1. These        cryptographic algorithms are provided for backward compatibility        only.      - The default value for certmapping and for excludecaname is no.      - The quotation mark () characters in the CA name must be replaced with a backslash character followed by a single quotation mark ( ').

Example 1

Consider the following example of a Netsh advfirewall command:

This command creates a connection security rule that has the following authentication methods in the authentication set:

•	The first authentication method is a certificate that uses RSA certificate signing.
•	The second authentication method is a health certificate that uses ECDSA256 for certificate signing.

The connection security rule protects traffic by using AH and ESP integrity with the new AES-GMAC 256 algorithm. The rule does not include encryption.

Example 2

Consider the following example of a Netsh advfirewall command:

This command creates a connection security rule that has one authentication method in the authentication set. The authentication method is a certificate that uses RSA certificate signing.

The connection security rule protects traffic by using AH and ESP integrity with SHA256 for integrity and with AES192 for encryption.

Modify an existing connection security rule

Netsh advfirewallUsage: set rule      group=<string> | name=<string>      [type=dynamic|static]      [profile=public|private|domain|any[,...] (default=any)]      [endpoint1=any|localsubnet|dns|dhcp|wins|defaultgateway|         <IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>]      [endpoint2=any|localsubnet|dns|dhcp|wins|defaultgateway|         <IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>]      [port1=0-65535|any]      [port2=0-65535|any]      [protocol=0-255|tcp|udp|icmpv4|icmpv6|any]      new      [name=<string>]      [profile=public|private|domain|any[,...]]      [description=<string>]      [mode=transport|tunnel]      [endpoint1=any|localsubnet|dns|dhcp|wins|defaultgateway|         <IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>]      [endpoint2=any|localsubnet|dns|dhcp|wins|defaultgateway|         <IPv4 address>|<IPv6 address>|<subnet>|<range>|<list>]      [action=requireinrequestout|requestinrequestout|         requireinrequireout|noauthentication]      [enable=yes|no]      [type=dynamic|static]      [localtunnelendpoint=<IPv4 address>|<IPv6 address>]      [remotetunnelendpoint=<IPv4 address>|<IPv6 address>]      [port1=0-65535|any]      [port2=0-65535|any]      [protocol=0-255|tcp|udp|icmpv4|icmpv6|any]      [interfacetype=wiresless|lan|ras|any]     [auth1=computerkerb|computercert|computercertecdsap256|computercertecdsap384|computerpsk|         computerntlm|anonymous[,...]]      [auth1psk=<string>]      [auth1ca=<CA Name> [certmapping:yes|no] [excludecaname:yes|no] ...]      [auth1healthcert=yes|no (default=no)]      [auth1ecdsap256ca=<CA Name> [certmapping:yes|no] [excludecaname:yes|no] ...]      [auth1ecdsap256healthcert=yes|no (default=no)]      [auth1ecdsap384ca=<CA Name> [certmapping:yes|no] [excludecaname:yes|no] ...]      [auth1ecdsap384healthcert=yes|no (default=no)]      [auth2=computercert| computercertecdsap256|computercertecdsap384|userkerb|usercert| usercertecdsap256|usercertecdsap384|userntlm|anonymous[,...]]      [auth2ca=<CA Name> [certmapping:yes|no] ...]      [auth2ecdsap256ca=<CA Name> [certmapping:yes|no] ...]      [auth2ecdsap384ca=<CA Name> [certmapping:yes|no] ...]      [qmsecmethods=         ah:<integrity>+esp:<integrity>-<encryption>+[valuemin]+[valuekb]|         default]Remarks:      - This sets a new parameter value on an identified rule. The command fails        if the rule does not exist. To create a rule, use the add command.      - Values after the new keyword are updated in the rule.  If there are        no values, or if the new keyword is missing, no changes are made.      - Only a group of rules can be enabled or disabled.      - If multiple rules match the criteria, all matching rules are         updated.      - The rule name should be unique, and it cannot be all.      - Auth1 and auth2 can be comma-separated lists of options.      - The computerpsk and computerntlm methods cannot be specified together        for auth1.      - Computercert cannot be specified by using user credentials for auth2.     - Certsigning options ecdsap256 and ecdsap384 are supported only on Windows Vista SP1 and on later versions of Windows Vista.        - Qmsecmethods can be a list of proposals that are separated by a comma (,).      - For qmsecmethods, integrity=md5|sha1|sha256| aesgmac128|aesgmac192|aesgmac256|aesgcm128|aesgcm192|aesgcm256 and        encryption=3des|des|aes128|aes192|aes256|aesgcm128| aesgcm192|aesgcm256      - If aesgcm128 or aesgcm256 is specified, it must be used for both ESP integrity and for encryption.       -  Sha-256, aesgmac128, aesgmac192, aesgmac256, aesgcm128, aesgcm192, and aesgcm256 are supported only on Windows Vista SP1 and on later versions of Windows Vista.      - If qmsemethods are set to default, qmpfs will be set to default also.      - Qmpfs=mainmode uses the main mode key exchange setting for PFS.      - We recommend that you do not use DES, MD5, or DHGroup1. These        cryptographic algorithms are provided for backward compatibility        only.      - The default value for certmapping and excludecaname is no.      - The quotation mark () characters in the CA name must be replaced with a backslash character followed by a single quotation mark ( ').

The following is an example of a command that updates the rule that was created in Example 1 in the previous section:

This command updates the rule to use AES-GCM 256 for ESP integrity and encryption and to use AES-GMAC 256 for AH integrity.

Set global Main-mode settings

The following Help text is for the Netsh advfirewall set global command.

netsh advfirewall>set globalUsage: set global statefulftp|statefulpptp  enable|disable|notconfigured      set global IPsec (parameter) (value)      set global mainmode (parameter) (value) | notconfiguredIPsec Parameters:      strongcrlcheck    - Configures how CRL checking is enforced.                          0: Disable CRL checking                          1: Fail if cert is revoked (default)                          2: Fail on any error                          notconfigured: Returns the value to its unconfigured state.      saidletimemin     - Configures the security association idle time in                          minutes.                        - Usage: 5-60|notconfigured (default=5)      defaultexemptions - Configures the default IPsec exemptions. The default is                          to exempt IPv6 neighbordiscovery protocol from                          IPsec.                        - Usage: none|neighbordiscovery|notconfiguredMain Mode Parameters:      mmkeylifetime     - Sets the main mode key lifetime in minutes, in sessions, or in both.                        - Usage: <num>min,<num>sess      mmsecmethods      - Configures the main mode list of proposals                        - Usage:                          keyexch:enc-integrity,enc-integrity[,...]|default                        - keyexch=dhgroup1|dhgroup2|dhgroup14|                          ecdhp256|ecdhp384                        - enc=3des|des|aes128|aes192|aes256                        - integrity=md5|sha1|sha256|sha384Remarks:      - This configures global settings, such as advanced IPsec options.      - We recommend that you do not use DES, MD5, or DHGroup1. These        cryptographic algorithms are provided for backward compatibility        only.      - The mmsecmethods keyword default sets the policy to the following:        dhgroup2-aes128-sha1,dhgroup2-3des-sha1      - Sha256 and sha384 are supported only on Windows Vista SP1 and on later versions of Windows Vista.

The following is an example of a command that uses the new SHA algorithms in the Main-mode cryptographic set:

Back to the top

Troubleshooting, configuration, and verification commands

The Netsh advfirewall consec show rule all command

The Netsh advfirewall consec show rule all command displays configuration for all connection security rules.

The following is a sample of output for this command.

Rule Name:				testEnabled:					YesProfiles:					Domain,Private,PublicType:					StaticMode:					TransportEndpoint1:				AnyEndpoint2:				AnyProtocol:					AnyAction:					RequestInRequestOutAuth1:					ComputerPSKAuth1PSK:				         12345MainModeSecMethods			         ECDHP384-3DES-SHA256,ECDHP384-3DES-SHA384QuickModeSecMethods			AH:AESGMAC256+ESP:AESGCM256-AESGCM256+60 min+100000kb

The Netsh advfirewall monitor show mmsa command

The Netsh advfirewall monitor show mmsa command displays the Main mode security association.

The following is a sample of output for this command.

Main Mode SA at 01/04/2008 13:10:09Local IP Address:				157.59.24.101Remote IP Address:			         157.59.24.119My ID:Peer ID:First Auth:				ComputerPSKSecond Auth:				NoneMM Offer:				         ECDHAP384-3DES-SHA256Cookie Pair:				203d57505:5d088705Health Pair:				NoOk.

The Netsh advfirewall monitor show qmsa command

The Netsh advfirewall monitor show qmsa command displays the Quick mode security association.

The following is a sample of output for this command.

Main Mode SA at 01/04/2008 13:10:09Local IP Address:				157.59.24.101Remote IP Address:			         157.59.24.119Local Port:				AnyRemote Port:				AnyProtocol:					AnyDirection:				BothQM Offer:				         AH:AESGMAC256+ESP:AESGCM256-AESGCM256+60min +100000kb	Ok.

The Netsh advfirewall show global command

The Netsh advfirewall show global command displays global settings.

The following is a sample of output for this command.

Global Settings:IPsec:					StrongCRLCheck				0:DisabledSAIdleTimeMin				5minDefaultExemptions			         NeighborDiscoveryIPsecThroughNAT			         Server and client behind NATStatefulFTP				EnableStatefulPPTP				EnableMain Mode:KeyLifetime				2min,0sessSecMethods				DHGroup1-3DES-SHA256,DHGroup1-3DES-SHA384

Back to the top

Interoperability

Creation, enforcement, and management of the IPsec policy that uses Suite B algorithms was introduced in Windows Vista SP1 and in Windows Server 2008. You can manage a Group Policy that contains Suite B algorithms only by using tools that were released with Windows Vista SP1 or with Windows Server 2008.

Sample scenarios and expected results are as follows.

Scenario 1

You use the new cryptographic algorithms to apply a policy that is created on a computer that is running Windows Server 2008 or Windows Vista SP1 to a computer that is running the release version of Windows Vista.

Expected result

If a rule contains cryptographic suites that use the new cryptographic algorithms, these cryptographic suites are dropped and other cryptographic suites in the cryptographic set are used instead.

If none of the cryptographic suites in the rule are recognized, the whole rule is dropped. An event is logged that indicates that the rule cannot be processed. Therefore, if all cryptographic suites in the key exchange cryptographic set are dropped, none of the connection security rules in the policy are applied. However, all firewall rules are still applied.

The authentication set process resembles the cryptographic set process. If a policy that contains the new certificate flags (ECDSA-P256 or ECDSA-P384) is applied to a computer that is running the release version of Windows Vista, the authentication methods are dropped.

If all authentication methods in the first authentication set are dropped for this reason, the whole rule is not processed. If all authentication methods in the second authentication set are dropped, the rule is processed by using only the first authentication set.

Scenario 2

On a computer that is running the release version of Windows Vista, you use the new cryptographic algorithms to view a policy that was created on a computer that is running Windows Server 2008 or Windows Vista SP1.

Expected result

The new algorithms are displayed as “unknown” in both the monitoring and authoring parts of the Windows Firewall Advanced Security MMC snap-in. The Netsh advfirewall command also displays the algorithms as “unknown” in Windows Vista.

Restrictions on interoperability

Restrictions on interoperability are as follows:

•	We do not support remote management of policies that use Suite B algorithms on computers that are running Windows Vista SP1 or Windows Server 2008 from a computer that is running the release version of Windows Vista.
•	When a policy that is created on a computer that is running Windows Vista SP1 or Windows Server 2008 is imported to a computer that is running the release version of Windows Vista, some parts of the policy are dropped. This occurs because the release version of Windows Vista cannot recognize the new algorithms.

Back to the top

Quick-mode cryptographic algorithm combinations that are supported and not supported

The following table shows supported Quick-mode cryptographic algorithm combinations.

Protocol	AH Integrity	ESP Integrity	Encryption
AH	AES-GMAC 128	None	None
AH	AES-GMAC 192	None	None
AH	AES-GMAC 256	None	None
AH	SHA256	None	None
AH	SHA1	None	None
AH	MD5	None	None
ESP	None	AES-GMAC 128	None
ESP	None	AES-GMAC 192	None
ESP	None	AES-GMAC 256	None
ESP	None	SHA256	None
ESP	None	SHA1	None
ESP	None	MD5	None
ESP	None	SHA256	Any supported encryption algorithm except AES-GCM algorithms
ESP	None	SHA1	Any supported encryption algorithm except AES-GCM algorithms
ESP	None	MD5	Any supported encryption algorithm except AES-GCM algorithms
ESP	None	AES-GCM 128	AES-GCM 128
ESP	None	AES-GCM 192	AES-GCM 192
ESP	None	AES-GCM 256	AES-GCM 256
AH+ESP	AES-GMAC 128	AES-GMAC 128	None
AH+ESP	AES-GMAC 128	AES-GMAC 128	None
AH+ESP	AES-GMAC 128	AES-GMAC 128	None
AH+ESP	SHA-256	SHA-256	None
AH+ESP	SHA1	SHA1	None
AH+ESP	MD5	MD5	None
AH+ESP	SHA256	SHA256	Any supported encryption algorithm except AES-GCM algorithms
AH+ESP	SHA1	SHA1	Any supported encryption algorithm except AES-GCM algorithms
AH+ESP	MD5	MD5	Any supported encryption algorithm except AES-GCM algorithms
AH+ESP	AES-GMAC 128	AES-GCM 128	AES-GCM 128
AH+ESP	AES-GMAC 192	AES-GCM 192	AES-GCM 192
AH+ESP	AES-GMAC 256	AES-GCM 256	AES-GCM 256

Note AES-GMAC is the same as AES-GCM with null encryption. For example, you can specify AH integrity to use AES-GMAC 128, and you can specify ESP Integrity to use AES-GCM 128. This is the only exception to the rule that AH and ESP integrity algorithms must be identical.

The combinations that are described in the following table are not supported.

Protocol	AH Integrity	ESP Integrity	Encryption
ESP	None	AES-GMAC 128	Any supported encryption algorithm
ESP	None	AES-GMAC 192	Any supported encryption algorithm
ESP	None	AES-GMAC 256	Any supported encryption algorithm
ESP	None	AES-GCM 128	1. None 2. Any encryption algorithm except AES-GCM 128
ESP	None	AES-GCM 192	1. None 2. Any encryption algorithm except AES-GCM 192
ESP	None	AES-GCM 256	1. None 2. Any encryption algorithm except AES-GCM 256
AH+ESP	AES-GMAC 128	AES-GMAC 128	Any supported encryption algorithm
AH+ESP	AES-GMAC 192	AES-GMAC 192	Any supported encryption algorithm
AH+ESP	AES-GMAC 256	AES-GMAC 256	Any supported encryption algorithm

For more information about Suite B, visit the following Web site:

For more information about IPsec and connection security rules, visit the following Microsoft Web site:

For more information about Cryptography Next Generation in Windows Server 2008, visit the following Microsoft Web site:

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

However, when you try to locate the Add and Remove buttons on the Server Farm tab, they appear to be missing.

Back to the top

The Add button is located in the upper-right corner of the window, and the Remove button is located in the lower-right corner.

Back to the top

Method 1

Enter information in the appropriate text boxes, and then click the corresponding buttons even if the buttons are partly obscured.

Method 2

Use the following keyboard shortcuts to access the Add and Remove buttons:

•	Press ALT+P to access the Add button.
•	Press ALT+B to access the Remove button.

Back to the top

Back to the top

Back to the top

Issues that this hotfix package fixes

This hotfix fixes the following issues that are not previously documented in a Microsoft Knowledge Base article:

•	Consider the following scenario: • On an Office SharePoint site, you set a document library’s document template type to Microsoft Office Word 97-2003 document (.doc). • On a client computer that is running Office Word 2007, you create a new document from the document library. In this case, when you try to save the document in Office Word 2007, the default document type that appears in the Save as type box of the Save As dialog box is Word Document (*.docx). Additionally, if you do not notice that Word Document (*.docx) is wrong document type for the document library on the SharePoint site, and then click Save in the Save As dialog box, a dialog box states that states that you are saving the document in the wrong document type . If you click Cancel in this dialog box, you notice that the Save As dialog box reappears. However, the file name is changes to some random numbers together with .tmp file name extension. For example, the file name may appear as 6AF9E345.tmp.docx.
•	In Office Word 2007, you add a XML schema to the schema library. Then, when you open or close a document that has the XML schema applied, you may notice that a memory leak occurs in Performance Monitor.
•	In Office Word 2007, you insert an object that is from an Internet address. After that, when you try to change the source of the linked object to another Internet address, you receive the following error message: You cannot use an Internet address here. Enter a path that points to a location on your computer or on the network.
•	Office Word 2007 stops responding when you try to open WordPerfect 5.1 files.
•	You embed a Word document object in a 2007 Microsoft Office file. However, you cannot save a copy of the Word document object to a network location in the Word 2007 format (.docx).

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

To apply this hotfix package, you must have Word 2007 installed.

Restart information

You do not have to restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

Registry information

To use one of the hotfixes in this package, you do not have to make any changes to the registry.

File information

This hotfix may not contain all the files that you must have to fully update a product to the latest build. This hotfix contains only the files that you must have to correct the issues that are listed in this article.The global version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Download information

File name	File version	File size	Date	Time	Platform
Office-kb941468-fullfile-x86-glb.exe	12.0.6300.5000	15,670,968	28-Jan-2008	17:55	x86

Microsoft Windows Installer .msp file information

File name	File version	File size	Date	Time	Platform
Word.msp	Not Applicable	13,064,704	28-Jan-2008	18:15	Not Applicable
Wordconv.msp	Not Applicable	6,239,232	28-Jan-2008	18:15	Not Applicable

After the hotfix is installed, the global version of this hotfix has the file attributes, or a later version of the file attributes, that are listed in the following table:

Contents of the Word.msp file

Contents of the Wordconv.msp file

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Back to the top

Back to the top

Back to the top

Back to the top