pb connect. domaine serveur 2003 av win98

[philou111]

Sur un poste avec Windows 98se je n'arrive pas à me connecter au reseau sur le domaine du serveur (win 2003 serveur std)

L'ad ip et le compte sont correctes

[Greywolf]

une piste à creuser:

les algorithmes de chiffrement des mots de passe réseaux utilisés sous 98 et NT>3.5 sont différents: Win9x encrypte avec LanMan et les serveurs NT >35 en NTLM

 

Win9x fait du LanMan et ne possède pas de fonctions de calcul d'empreinte NTLM (du moins en natif). Seuls les clients à partir de winME sont équipées de la fonction NTLM

 

Peut-être que win2003 Srv n'accepte (par souci de sécurité) que les empreintes NTLM.

Si tu disposes d'une clé de BDR NoLMHash positionnée à 1, ceci est fort probable.

http://support.microsoft.com/kb/q299656/

 

sinon, il semble possible de faire ingurgiter du NTLM à win98:

 

Choosing the NTLM Authentication Level

Windows 98 uses older, less secure authentication LM encryption by default. Vulnerabilities and exploits have been published against them, and Microsoft has strengthened the authentication security protocols to mitigate these vulnerabilities. After the DS Add-On client has been configured, you can set it to use the more secure NTLMv2 authentication method.

With DSClient installed, Windows 98 supports two levels of NTLM and NTLMv2 authentication that are controlled by the LMCompatibility registry value described later in this chapter. These values are:

•

0 (Send LM & NTLM responses). Offers the most interoperability. Clients may use LM or either version of NTLM to authenticate.

•

3 (Send NTLMv2 response only). Use this value only if all clients with earlier operating system versions have DSClient installed.

Trey initially deployed the registry key with a value of 0, which mirrored the existing environment. After the Windows NT 4.0 servers at Trey had been upgraded as described in Chapter 4, "Hardening Microsoft Windows NT 4.0," Trey reset the LMCompatibility value on computers running Windows 98 to 3.

The default installation of NTLMv2 encryption provides 56-bit key lengths on systems where the 56-bit version of Internet Explorer is installed. Systems where Internet Explorer was installed after 1999 probably have the 128-bit version; older clients can be upgraded to 128-bit encryption as described in the preceding chapter. If the 128-bit version of Internet Explorer is installed before you install the DSClient, 128-bit NTLMv2 authentication will be enabled. As described in Chapter 4, “Hardening Microsoft Windows NT 4.0,” Trey installed the 128-bit update on its computers running Windows 98 and deployed NTLMv2 authentication support for all its computers. After these changes were in place, Trey was able to proceed with enabling NTLMv2 support on servers and domain controllers.

 

http://www.microsoft.com/technet/security/...y/legsgch5.mspx