IAS Incorrectly Validates User Accounts

ID: Q197506

The information in this article applies to:

Microsoft Internet Authentication Service
Microsoft Commercial Internet System version 2.0
Microsoft Windows NT 4.0

SYMPTOMS

The Microsoft Internet Authentication Service incorrectly validates users in the following two cases:

Setup PAP authentication on the Network Access Server (NAS)
Have domain/local guest account enabled

Setup PAP or ms-chap authentication on the NAS
Uncheck "allow dial in" checkbox

CAUSE

The Internet Authentication Service did not verify that the guest account is enabled or that the user has "allow dial in" access.

RESOLUTION

A supported fix that corrects this problem is now available from Microsoft, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. If you are not severely affected by this specific problem, Microsoft recommends that you wait for the next MCIS service pack.

To resolve this problem immediately, contact Microsoft Product Support Services to obtain the fix. For a complete list of Microsoft Product Support Services phone numbers and information on support costs, please go to the following address on the World Wide Web:

http:/ /support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or later:


Date     Time    Version      Size    File name   Platform
-----------------------------------------------------------
01/26/99  10:43p  4.71.1015.0   322,784 Update.exe   (x86)
01/22/99  10:06p  4.71.1015.0   258,272 Iaspack.exe  (x86)
01/22/99  09:53p   6.0.2723.0    20,480 Authsam.dll  (x86)
01/22/99  09:53p   6.0.2723.0   487,936 Authsrv.exe  (x86)
01/23/99  03:31p                 43,520 Rassfm.dll   (x86)
01/26/99  10:38p                  7,911 Readme.htm   (x86)
01/22/99  05:37p                    399 Setup.inf    (x86)
01/26/99  07:55p                  1,224 Setup.SED    (x86)

01/26/99  10:43p  4.71.1015.0   322,784 Update.exe   (alpha)
01/22/99  10:06p  4.71.1015.0   258,272 Iaspack.exe  (alpha)
01/22/99  09:53p   6.0.2723.0    20,480 Authsam.dll  (alpha)
01/22/99  09:53p   6.0.2723.0   487,936 Authsrv.exe  (alpha)
01/23/99  03:31p                 43,520 Rassfm.dll   (alpha)
01/26/99  10:38p                  7,911 Readme.htm   (alpha)
01/22/99  05:37p                    399 Setup.inf    (alpha)
01/26/99  07:55p                  1,224 Setup.SED    (alpha)

NOTE: If you contact Microsoft to obtain this fix, a fee may be charged. This fee is refundable if it is determined that you only require the fix you requested. However, this fee is non-refundable if you request additional technical support, if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support.

For more information about eligibility for no-charge technical support, see the following article in the Microsoft Knowledge Base:

Q154871 Determining If Your Product Is Eligible for No-Charge Technical Support

STATUS

Microsoft has confirmed this to be a problem in Microsoft Commercial Internet System version 2.0.

MORE INFORMATION

This fix requires that Windows NT Service Pack 4 (SP4) is installed. If SP4 is installed after applying this fix, the properties page may become unusable. The following error message may occur:

The Internet Authentication Service database is not properly installed.

To install the hotfix, run the Update.exe program.

NOTE: This fix also adds two new abilities:

Adds the ability to use standard Chap authentication (instead of MS-Chap) against a Windows NT 4.0 SP4 PDC/BDC. You need to install this fix on the IAS (Radius server) and every domain controller. Users will need to change their password the next time they log on. The password needs to be changed in either Windows NT User Manager or through a password change Web page. Microsoft does not support changing passwords with the Windows 95 Administrator tools for Windows NT. Password changes may take up to 30 minutes to replicate between all the PDCs and BDCs.

Adds support for MS-Chap 2.0 to Microsoft Radius. By default, an RRAS server running SP4 or later acting as a Radius client (NAS Server) will send an MS-Chap 2.0 request only (previous service packs send a MSCHAPV1 request). It is advisable to run the very latest service pack on RRAS and Microsoft Radius when doing Chap or MS-Chap authentication.

Microsoft Radius server also maintains support for MS-Chap 1.0 for compatibility with MS-Chap implementations from third-party NAS hardware vendors (Cisco, Ascend, and so on.)

Additional query words:


Keywords          : Mcis2Sp2fix 
Version           : winnt:2.0,4.0
Platform          : winnt 
Issue type        : kbbug

Last Reviewed: July 30, 1999