Microsoft Windows XP and Network Level Authentication not supported – Real Solution [Not a way around]

Continuing series of my experiences with new Windows 7 I’d like to share solution for one more annoyance artificially created by our dear beloved Microsoft.

What is it Network Level Authentication ?

It’s a new and more secure way to establish RDP connection to remote host and which require less resources prior to completion of authentication process, thus making host more resilient to DDS attacks. Additional layers of encryption [TLS 1.0/FIPS 140-1&2] plus single-sign on  is also a nice add-on.

Rumors have been around about Windows XP Service Pack 3 will enable ability to use NLA to connect to Vista/Windows 7/Windows 2008 Server hosts , but alas the miracle didn’t happened (almost).

Why almost? Because Microsoft did include required files to support NLA or more precisely it’s core component - the new Credential Security Support Provider (CredSSP) protocol, but “forgot” to enable it by default.

Luckily they left back door open to enable CredSSP on XP SP3, but it’s a bit tricky as it involves tweaking Windows Registry.

To enable NLA in XP machines; first install Windows XP SP3, then edit the registry settings on the XP client machine to allow NLA

Steps to Configure Network Level Authentication:

1. Click Start, click Run, type regedit, and then press ENTER.
2. In the navigation pane, locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa
3. In the details pane, right-click Security Packages, and then click Modify.
4. In the Value data box, type tspkg in new line. Leave any data that is specific to other SSPs, and then click OK.
5. In the navigation pane, locate and then click the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders
6. In the details pane, right-click SecurityProviders, and then click Modify.
7. In the Value data box, type credssp.dll . Leave any data that is specific to other SSPs, and then click OK. (add comma between last entry and credssp.dll)
8. Exit Registry Editor.
9. Restart the computer.

Now when you run remote desktop you will notice that Network Level Authentication is supported. To check this, right-click the top left hand corner of a remote desktop session and choose, Help > About

More info here and here

How to upgrade Window 7 Beta to RC/Retail [rTM] [Updated]

Here’s another fine example how Microsoft hates early software adapters – in order to upgrade to final retail version of newest operating system Windows 7 from it’s beta - MS suggests to downgrade to Windows Vista before upgrade ?! BOOOOOOOOOOO!!!

Luckily for us they also give us geeks (aka IT experts) there is a way around operating system check during installation and here is the steps according to Microsoft, one will have to perform in order to bypass the OS verification.

Here’s what you can do to bypass the check for pre-release upgrade IF YOU REALLY REALLY NEED TO:

1. Download the ISO as you did previously and burn the ISO to a DVD.
2. Copy the whole image to a storage location you wish to run the upgrade from (a bootable flash drive or a directory on any partition on the machine running the pre-release build).
3. Browse to the sources directory.
4. Open the file cversion.ini in a text editor like Notepad.
5. Modify the MinClient build number to a value lower than the down-level build. For example, change 7100 to 7000 (pictured below).
6. Save the file in place with the same name.

Run setup like you would normally from this modified copy of the image and the version check will be bypassed.

These same steps will be required as we transition from the RC milestone to the RTM milestone.

Again, we know many people (including tens of thousands at Microsoft) are relying on the pre-release builds of Windows 7 for mission critical and daily work, making this step less than convenient. We’re working hard to provide the highest quality release we can and so we’d like to make sure for this final phase of testing we’re supporting the most real world scenarios possible, which incremental build to build upgrades are not. At the same time everyone on the beta has been so great we wanted to make sure we at least offered an opportunity to make your own expert and informed choice about how to handle the upgrade.

We’re always humbled by the excitement around the releases and by the support and enthusiasm from those that choose to run our pre-releases. We’re incredibly appreciative of the time and effort you put into doing so. In return we hope we are providing you with a great release to work with at each stage of the evolution of the product. Our next stop is the RC…see you there!

THANK YOU!

–Windows 7 Team

I ‘m going to try the procedure myself once the Windows 7 Release Candidate is out to see how it works.

Update:
I followed my own advice and updated my and my boss’s work pcs from Beta 7000 to RC 7100 without ANY issues. So workaround works. Confirmed.

Windows Server Administration Tools For windows 7 [Updated]

In case you got used to have DSA.MSC and DSite.MSC tools on you Windows XP workstation to manage Microsoft Windows 2003 Servers, and can’t live without them on your new Windows 7 Beta, unlike Windows Vista with got crappy batch file to fix broken install, Windows 7 gets its own Server Administration Package called:

Remote Server Administration Tools for Windows  7 [RC]

Which is basically same thing, but fully compatible to Windows 7. 
Remember after finishing download & install, go to Control Panel/ Programs and features / “Turn Windows Features on or off” and Enable the tools you want from “Remote Server Administration Tools selection.

Enjoy!

P.S: Microsoft provided versions for both 32 and 64 bit systems.
P.S.S: I tried to install Adminpak.msi for Vista and fiddle with settings/permissions – Nothing really works – Don’t waste your time.

Update:
Original link was pointing to RSAT for beta, since then the tools updated for RC version.

Windows 7 (and Vista) Accelerated Wheel Scrolling Problem

Me and my boss decided to give Windows 7 Beta a test ride and the results are very positive for now, except very few small annoyances and one of them, like one mentioned in the title I’ll talk today.

Both Vertical and Horizontal scrolling works, but they weren’t accelerated. Not a huge deal, but once you had it working fine in Windows XP – I see no reason to give up and readjust.

It appears the problem can appear both in Logitech and Microsoft mice products and their corresponding drivers in current versions. Tweaking the settings 100 million times were fruitless, but as always solution was found on forums:

http://forums.techarena.in/vista-help/970194.htm#post4332525

In short version the idea is to switch your mouse driver with different one.

The solution worked perfectly, with only difference – I picked the Microsoft Sidewinder mouse, which is a perfect button wise match to my Wireless IntelliMouse Explorer 2.0  mouse, so I got all buttons to work plus I didn’t loose my horizontal scrolling – which I have to admit use very rarely.

P.S: Apparently the this way around applies only for Microsoft devices and its driver. Sorry Logitech owners…

If you found different fix and/or way around – don’t be shy and share with all of us

Epic Fail: IE 8 Final vs Acid 3 Test

20/100 - I can’t believe brand new Internet Explorer 8 such miserably fails at this test.

C’mon Microsoft – after all the talks about making new IE more internet standards compatible makes a U-turn and makes up their own standards as it goes… Microsoft - Business as usual.

Go ahead and keep doing what you always do, but ask yourself – How the heck did we (MSFT) lost 99.5% market share only a few year ago to current 66% [and dropping]

A small kudos to Microsoft – IE8 passes Acid Test 2 with flying colors – its about freaking time.

Link: Acit 3 Test

P.S: A small update – On Windows 7 beta with all latest updated, IE8 scores 21/100. Not exactly a reason for joy ether…