In this scenario, the application may crash.

Back to the top

Back to the top

Windows Vista hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista with Service Pack 1, x86-based versions

Windows Vista, x64-based versions

Windows Vista with Service Pack 1, x64-based versions

Windows Vista with Service Pack 1, Itanium-based versions

Back to the top

Windows Server 2008 hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2008, x86-based versions

Windows Server 2008, Itanium-based versions

Windows Server 2008, x64-based versions

Back to the top

Back to the top

For more information about how an application can provide performance counter data by using the performance counter version 2.0 APIs, visit the following Microsoft Web site:

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

• You use Microsoft iSCSI Initiator to connect to an iSCSI target from a computer that is running Windows Vista or Windows Server 2008.
• An iSCSI Protocol Data Unit (PDU) is rejected by the target for one of the reasons that are outlined in section 10.17.1 of iSCSI Specification Request for Comment (RFC) 3720.

In this scenario, iSCSI Initiator should resend the PDU that was rejected by the iSCSI target. However, iSCSI Initiator may be unable to communicate with the iSCSI target for several minutes.

Specifically, iSCSI Initiator cannot communicate with the target for a period of five times the Disk Timeout value that is specified in the following registry entry:

After a period of five times the Disk Timeout Value elapses, iSCSI Initiator performs session recovery, and then the iSCSI session is dropped and reestablished. Eventually, iSCSI Initiator may be able to communicate with the iSCSI target again.

Back to the top

Hotfix information

Important Windows Vista and Windows Server 2008 hotfixes are included in the same packages. However, only one of these products may be listed on the “Hotfix Request” page. To request the hotfix package that applies to both Windows Vista and Windows Server 2008, just select the product that is listed on the page.

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

To apply this hotfix on a Windows Vista-based computer, you must have Windows Vista Service Pack 1 installed.

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

No prerequisites are required for Windows Server 2008-based computers.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into Windows Server 2008.
• The MANIFEST files (.manifest) and MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported Itanium-based versions of Windows Server 2008

Back to the top

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

For more information about software update terminology, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Additional file information for Windows Vista and for Windows Server 2008

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported Itanium-based versions of Windows Server 2008

Back to the top

However, you may notice that the audio application cannot play the following formats:

• The latest non-PCM formats, such as Dolby True HD
• Both PCM and non-PCM audio formats that are encrypted

Back to the top

When the audio application selects a specific audio format to transfer stream data, the audio miniport driver should see the corresponding KSDATAFORMAT structure that contains the specific GUID and other parameters in the miniport’s handlers. For example, the audio miniport driver should see the NewStream() parameter. When the audio driver encounters these parameters, the driver takes some action, based on the specific GUID.

However, in Windows Vista-based or Windows Server 2008-based computers, the system audio stack (Portcls.sys) may pass a KSDATAFORMAT instance with a different GUID to the WaveRT miniport’s NewStream() parameter.

For example, there can be two data ranges that have the same sample rates, but the data ranges have a different number of channels. In this case, the system may detect one data range that is the first data range that matches the sample rate and the sample bit in the array. However, the channel number is incorrect.

Therefore, the audio driver does not obtain the correct data format. Because the driver does not obtain the correct data format, the audio driver cannot function correctly with regard to the audio format that was selected in the application, and the function fails.

Back to the top

Hotfix information

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Prerequisites

No prerequisites are required to install this hotfix.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.600 0 . 20 xxx	Windows	RTM	LDR
  6.0.600 1 . 22 xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000.xxxxxx version number.
• The MANIFEST files (.manifest) and MUM files (.mum) installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported 32-bit versions of Windows Server 2008 and of Windows Vista

For all supported 64-bit versions of Windows Server 2008 and of Windows Vista

For all supported Itanium-based versions of Windows Server 2008

Back to the top

For more information about WAVEFORMATEXTENSIBLE, visit the following Web site:

For more information about KSDATAFORMAT, visit the following Web site:

For more information about WaveRT, visit the following Web sites:

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported 32-bit versions of Windows Server 2008 and of Windows Vista

Additional files for all supported 64-bit versions of Windows Server 2008 and of Windows Vista

Additional files for all supported Itanium-based versions of Windows Server 2008

Back to the top

When this issue occurs, the following event may be logged in the System log:

Log Name: System
Source: Microsoft-Windows-Kernel-General
Date: date & time
Event ID: 5
Task Category: None
Level: Error
Keywords:
User: SYSTEM
Computer: computer name
Description:{Registry Hive Recovered} Registry hive (file): ‘ ?? C: Users user name ntuser.dat’ was corrupted and it has been recovered. Some data might have been lost.

Note This issue frequently occurs on Windows Server 2008-based terminal servers.

Back to the top

Windows Server 2008 and Windows Vista SP1 try to correct profiles when the profiles are corrupted. However, the registry self-correcting feature incorrectly calculates a structure size. Therefore, the system accesses an invalid memory address.

Back to the top

Hotfix information for Windows Server 2008

A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing the problem described in this article. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix.

If the hotfix is available for download, there is a Hotfix download available section at the top of this Knowledge Base article. If this section does not appear, contact Microsoft Customer Service and Support to obtain the hotfix.

Note If additional issues occur or if any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. For a complete list of Microsoft Customer Service and Support telephone numbers or to create a separate service request, visit the following Microsoft Web site:

Note The Hotfix download available form displays the languages for which the hotfix is available. If you do not see your language, it is because a hotfix is not available for that language.

Important Windows Vista and Windows Server 2008 hotfixes are included in the same packages. However, only one of these products may be listed on the “Hotfix Request” page. To request the hotfix package that applies to both Windows Vista and Windows Server 2008, just select the product that is listed on the page.

Prerequisites

To apply this hotfix, you must be running Windows Server 2008 or Windows Vista Service Pack 1.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other previously released hotfixes.

Registry information

To use this hotfix, you do not have to make any changes to the registry.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2008 and Windows Vista file information note

The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately . MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

Windows Server 2008 and Windows Vista, x86-based version

Windows Server 2008 and Windows Vista, x64-based version

Windows Server 2008, Itanium-based version

Back to the top

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported Itanium-based versions of Windows Server 2008

Back to the top

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Vista, x86-based versions

Windows Vista, 64-bit versions

Back to the top

Back to the top

For more information, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

This problem occurs if the document was created by right-clicking the desktop, pointing to New, and then clicking WordPad Document. When you do this is Windows XP, the WordPad document uses the .doc file name extension.

Back to the top

Back to the top

Back to the top

When this behavior occurs, Windows Vista is running in reduced functionality mode. When Windows Vista is running in reduced functionality mode, the taskbar does not appear. Additionally, you have limited access to Windows Vista programs and features.

This article describes how to install Windows Vista Service Pack 1 (SP1) when Windows Vista is running in reduced functionality mode because the activation period has expired. After you install Windows Vista SP1, you can access data.

Back to the top

Important If you install Windows Vista SP1 while Windows Vista is in reduced functionality mode, you cannot uninstall Windows Vista SP1.

1.	Log on to the Windows Vista-based computer.
2.	After the message that is mentioned in the Symptoms section appears, click Access your computer with reduced functionality.
3.	In Internet Explorer, type one of the following URLs in the Address bar: Windows Vista, 32-bit versions http://www.microsoft.com/downloads/details.aspx?FamilyId=B0C7136D-5EBB-413B-89C9-CB3D06D12674 (http://www.microsoft.com/downloads/details.aspx?FamilyId=B0C7136D-5EBB-413B-89C9-CB3D06D12674) Windows Vista, 64-bit versions http://www.microsoft.com/downloads/details.aspx?FamilyId=874A414B-32B2-41CC-BD8B-D71EDA5EC07C (http://www.microsoft.com/downloads/details.aspx?FamilyId=B0C7136D-5EBB-413B-89C9-CB3D06D12674)
4.	Follow the steps to download and to install Windows Vista SP1.

Note After you install Windows Vista SP1, you will be asked to activate Windows Vista. However, access to files, to data, and to programs should not be restricted. This behavior applies only if the activation period had expired. It does not apply if any other non-genuine activity has occurred.

Back to the top

For more information about how exit reduced functionality mode in Windows Vista, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Back to the top

Back to the top

Back to the top

treeDiv = srcDoc.createElement(DIV);treeDiv.id = treeDiv;treeDiv.className = treeDiv;treeDiv.style.pixelTop = 0;scrollDiv.appendChild(treeDiv);treeDiv.onresize = treeResize;treeDiv.innerHTML = loadTree(treeXML);

Back to the top

By default, SSTP is configured to listen on all interfaces. For example, SSTP is configured to listen on 0.0.0.0 for IPv4 or ::/0 for IPv6. By default, Routing and Remote Access Services allows for VPN connections to travel over all IPv4 and IPv6 addresses that are available on the computer. Also, Routing and Remote Access Services always sets the computer certificate, also known as the machine certificate, to Http.sys. Http.sys is the HTTPS listener component on a Windows Server 2008-based computer that is running Routing and Remote Access Services together with 0.0.0.0:PortNum and [::]:PortNum.

This article describes how an administrator can block SSTP connections from specific IPv4 or IPv6 IP addresses or from specific interfaces.

Back to the top

Back to the top

Method 1: Configure the appropriate packet filter

Back to the top

Method 2: Configure the certificate for a specific IP address:port for the HTTP listener

Note To run the following commands, you must open the command prompt by using elevated permissions. To do this, click Start, right-click Command Prompt, and then click Run as administrator.

1.	Delete the certificate from Http.sys. To do this, type the following commands at the command prompt, where 443 is the SSTP port number: netsh http delete sslcert ipport=0.0.0.0:443 netsh http delete sslcert ipport=[::]:443
2.	Add the new certificate to Http.sys. To do this, type the following commands at the command prompt: netsh http add sslcert ipport=IPv4 address for the HTTP listener:443 certhash= xxx appid={ba195980-cd49-458b-9e23-c84ee0adcd75} certstorename=MY netsh http add sslcert ipport=IPv6 address for the HTTP listener:443 certhash= xxx appid={ba195980-cd49-458b-9e23-c84ee0adcd75} certstorename=MY Note In these commands, xxx is a placeholder for the SHA1 certificate hash of the new certificate.
3.	At the command prompt, type the following command, and then press ENTER to configure the Sha256CertificateHash registry subkey value for the SSTP service: reg add HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Services SstpSvc Parameters /v SHA256CertificateHash /t REG_BINARY /d Sha256 hash value for the IIS Web server certificate /f Note If you cannot locate the SHA256 certificate hash of the computer certificate, complete steps a through e to configure a value for the Sha256CertificateHash registry subkey. a. Restart the Routing and Remote Access service. b. Configure any 32-byte binary value as a temporary value for the Sha256CertificateHash registry key at the registry location that is mentioned in step 3. This registry key has to be of type REG_BINARY. c. On a different computer, create a VPN connection that is SSTP-based where the VPN destination is the host name of the Routing and Remote Access Server. d. Connect to the VPN connection. The connection will fail. Open Event Viewer on the client computer, and then locate the following event: Cryptographic binding failed for the client connection. The reason is client and the server have mismatched certificate hashes configured. SHA1 Certificate Hash: HashValue SHA256 Certificate Hash: HashValue ` e. Note the value of SHA256 certificate hash in the event on the client computer, and then use this value for the Sha256CertificateHash registry key on the Routing and Remote Access server.
4.	Restart the Routing and Remote Access server. Http.sys is now set to listen on a particular IP address:port. HTTPS connections are dropped from other IP address:ports.

Back to the top

In this scenario, the computer stops responding.

Back to the top

Back to the top

Hotfix information

A supported hotfix is now available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next Windows Server 2008 service pack that contains this hotfix.

To resolve this problem, submit a request to Microsoft Online Customer Services to obtain the hotfix. To submit an online request to obtain the hotfix, visit the following Microsoft Web site:

Note If additional issues occur or any troubleshooting is required, you might have to create a separate service request. The usual support costs will apply to additional support questions and issues that do not qualify for this specific hotfix. To create a separate service request, visit the following Microsoft Web site:

Prerequisites

To apply this hotfix, you must have Windows Server 2008 installed.

Restart requirement

You must restart the computer after you apply this hotfix.

Hotfix replacement information

This hotfix does not replace any other hotfixes.

File information

The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2008, x86 version

Windows Server 2008, x64 version

Windows Server 2008, IA-64 version

Back to the top

Back to the top

• Home users:
  http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx (http://www.microsoft.com/protect/computer/updates/bulletins/200811.mspx)

  Skip the details: Download the updates for your home computer or laptop from the Microsoft Update Web site now:

  http://update.microsoft.com/microsoftupdate (http://update.microsoft.com/microsoftupdate/)
• IT professionals:
  http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx (http://www.microsoft.com/technet/security/bulletin/MS08-068.mspx)

Back to the top

How to obtain help and support for this security update

For home users, no-charge support is available by calling 1-866-PCSAFETY in the United States and Canada or by contacting your local Microsoft subsidiary. For more information about how to contact your local Microsoft subsidiary for support issues with security updates, visit the Microsoft International Support Web site:

North American customers can also obtain instant access to unlimited no-charge e-mail support or to unlimited individual chat support by visiting the following Microsoft Web site:

For enterprise customers, support for security updates is available through your usual support contacts.

Back to the top

Known issues with this security update

Symptoms

After you apply this security update, applications such as Microsoft SQL Server or Internet Information Services (IIS) may fail when they make local NTLM authentication requests.

Cause

This problem occurs because of the way that NT LAN Manager (NTLM) treats different naming conventions as remote entities instead of as local entities. A local authentication failure might occur when the client calculates and caches the correct response to the NTLM challenge that is sent by the server in local lsass memory before the response is sent back to the server. When the server code for NTLM finds the received response in the local lsass cache, the code does not honor the authentication request and treats it as a replay attack. This behavior leads to a local authentication failure.

Resolution

To resolve this problem, you must disable reflection protection so that the affected systems can be authenticated. For more information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

How to disable NTLM reflection protection

ImportantThis section, method, or task contains steps that tell you how to change the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

To disable NTLM reflection protection, you must modify a registry key on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. On the Edit menu, point to New, and then click DWORD Value.
4. Type DisableLoopbackCheck for the name of the DWORD, and then press ENTER.
5. Right-click DisableLoopbackCheck, and then click Modify.
6. In the Value data box, type 1, and then click OK.
7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection

Because the NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system by setting DisableLoopbackCheck to 1 returns the system to a vulnerable state. Therefore, we strongly recommend that you use the BackConnectionHostNames registry key if needed.

How to re-enable NTLM reflection protection

To re-enable NTLM reflection protection, you must modify a registry entry on the client computer. To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa
3. Right-click DisableLoopbackCheck, and then click Modify.
4. In the Value data box, type 0, and then click OK.
5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

How to disable NTLM reflection protection for a particular SPN

You can disable NTLM reflection protection for a particular Service Principal Name (SPN) that is causing the corresponding authentication to break.To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. On the Edit menu, point to New, and then click Multi-String Value.
4. Type BackConnectionHostNames for the name of the Multi-String Value, and then press ENTER.

   Note If the BackConnectionHostNames registry entry exists as a REG_DWORD, you must delete the BackConnectionHostNames registry entry.

5. Right-click BackConnectionHostNames, and then click Modify.
6. In the Value data box, type the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

7. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

The effect of disabling NTLM reflection protection for a particular SPN

Because NTLM reflection protection is part of the fix for this SMB vulnerability, disabling NTLM reflection protection on an affected system will return the system to a vulnerable state for the particular SPN for which the reflection protection was disabled.

How to re-enable NTLM reflection protection for a particular SPN

To do this, follow these steps on the client computer:

1. Click Start, click Run, type regedit in the Open box, and then click OK.
2. Locate and then click the following subkey in the registry:
   HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Control Lsa MSV1_0
3. Right-click BackConnectionHostNames, and then click Modify.
4. In the Value data box, delete the CNAME or the DNS alias that is used for the local shares on the computer, and then click OK.

   Note You must type each host name on a separate line.

5. Exit Registry Editor, and then restart the computer.

Note You must restart the computer for this change to take effect.

Back to the top

File information

The English (United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time (UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time (DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

For all supported editions of Microsoft Windows 2000 Service Pack 4

Windows XP and Windows Server 2003 file information notes

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the SP requirement and Service branch columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that has a Microsoft digital signature.

For all supported x86-based versions of Windows XP

For all supported x64-based versions of Windows Server 2003 and of Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Windows Vista and Windows Server 2008 file information notes

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table.
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) have a Microsoft digital signature.

For all supported x86-based versions of Windows Server 2008 and of Windows Vista

For all supported x64-based versions of Windows Server 2008 and of Windows Vista

For all supported IA-64-based versions of Windows Server 2008

Back to the top

Additional file information for Windows Server 2008 and for Windows Vista

Additional files for all supported x86-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported x64-based versions of Windows Server 2008 and of Windows Vista

Additional files for all supported IA-64-based versions of Windows Server 2008