128 bit SECUR32.DLL - Myth or Missing?

[jds]

Background : I'm investigating connectivity problems of W98SE on a Server 2008 based LAN. Since the IT department is antagonistic to W98SE, any configuration changes (at the server) to help W98SE are basically not an option.

From some material I've read, the problem may be that 128 bit encryption for NTLMv2 may be required by default on a Server 2008 LAN..

http://support.microsoft.com/kb/239869 says :

By default, NTLM 2 session security encryption is restricted to a maximum key length of 56 bits. Optional support for 128-bit keys is automatically installed if the system satisfies United States export regulations. To enable 128-bit NTLM 2 session security support, you must install Microsoft Internet Explorer 4.x or 5 and upgrade to 128-bit secure connection support before you install the Active Directory Client Extension.

To verify your installation version:

1. Use Windows Explorer to locate the Secur32.dll file in the %SystemRoot%\System folder.

2. Right-click the file, and then click Properties.

3. Click the Version tab. The description for the 56-bit version is "Microsoft Win32 Security Services (Export Version)." The description for the 128-bit version is "Microsoft Win32 Security Services (US and Canada Only)."

Now, I have Internet Explorer 5.01 SP2;Q313829 (5.00.3314.2101) installed, and it says it's 128 bit, yet my SECUR32.DLL file says "Microsoft Win32 Security Services (Export Version)", so that's apparently 56 bit.

I've tried installing 'dsclient9x.msi' (Active Directory Client Extension) which installs 'SECUR32.DLL' version 4.10.2226, also '266772USA8.EXE' which installs SECUR32.DLL version 4.10.2228. Despite the latter having "USA" in it's title, still the version string for 'SECUR32.DLL' is indicating "(Export Version)".

All these steps individually and/or together are supposed to result in the 128 bit version of 'SECUR32.DL'. So, does the 128 bit version described in the above (and other) KB actually exist???

BTW, same exercise with a W98SE PC with IE6SP1, produced the same result.

Also BTW, versions 5.5 and newer of IE are supposed to come with 128 bit encryption as standard, older versions (down to v4, if I recall) can be upgraded to 128 bit, as with the above 5.01SP2.

Joe.

[jaclaz]

I seem to remember that it is DUN reinstalling needed.

Mdgx's site down?

http://webcache.googleusercontent.com/search?q=cache:TC689xZY1OcJ:www.mdgx.com/web.htm+/search%3Fhl%3Dit%26q%3D%2Bsite:mdgx.com%2Bmdgx%2Bdun%2Bweb&cd=2&hl=it&ct=clnk&gl=it

Microsoft Windows 98 SE Dial-Up Networking (DUN) Upgrade v1.4 adds 128-bit PPTP encryption:

Direct download [459 KB, English].

If already installed Active Directory Services (ADS) Client for Windows 9x/ME [2.95 MB], you MUST uninstall it BEFORE installing DUN Upgrade 1.4! Reinstall ADS Client AFTER that.

More info.

ADS Client info.

ADS Client installs NEWer versions of MSNET32.DLL, MSNP32.DLL, SECUR32.DLL, DFS.VXD, VNETSUP.VXD + VREDIR.VXD!

Links:

KB:

http://web.archive.org/web/20050316085327/http://support.microsoft.com/?id=285189

Direct download:

http://www.am.net/lib/TOOLS/Microsoft/Win98/se/dun14-SE.exe

jaclaz

[jds]

I seem to remember that it is DUN reinstalling needed.

Mdgx's site down?

jaclaz

Ahhh, I forgot to mention, I've tried installing DUN 1.4 too (I've tried lots of things over the past few days, I'm losing my mind;-)! BTW, there's a KB that says you must uninstall DSCLIENT before installing DUN, after which you can then reinstall DSCLIENT. Unfortunately, that also didn't help (if I recall, DUN didn't do anything to SECUR32.DLL).

At this point, I'm wondering if the SECUR32.DLL version as described in the KB's (eg.kb239869) actually exists?!

BTW, on the other matter of MDGx's site, it says "This site has been suspended". I hope that's a temporary problem! It was OK 24 hours ago.

Joe.

Edited November 13, 2010 by jds

[erpdude8]

Also BTW, versions 5.5 and newer of IE are supposed to come with 128 bit encryption as standard, older versions (down to v4, if I recall) can be upgraded to 128 bit, as with the above 5.01SP2.

that's because the 128-bit versions of IE 5.01 SP, IE 5.5 and IE 6.0 install 128-bit versions of the RSAENH.DLL & SCHANNEL.DLL files and NOT the 128-bit version of the SECUR32.DLL file. Installing/upgrading to the 128bit encryption edition of IE does not upgrade the SECUR32.DLL file to 128-bit version.

I don't think there is a secur32.dll file for Win9x that has 128-bit encryption. It's more likely that it's a myth to me. The stuff from Microsoft KB article 239869 is somewhat convoluted and not entirely accurate. If a 128-bit version of secur32.dll does exist, it's probably for NT-based OSes only.

if dsclient for win9x doesn't install the correct version of the secur32.dll file, you may want to read the following Annoyances.org thread:

http://www.annoyances.org/exec/forum/win2003/t1128901046

Edited November 13, 2010 by erpdude8

[triger49]

Hi

Try this...it applies to Server 2003 and they changed some things but

if memory serves it is the Dsclient software you need....been awhile

since I dealt with this...

http://support.microsoft.com/default.aspx?scid=kb;en-us;555038

HTH

Jake

Edit; scratch this idea...it's the old version....I was told Microsoft updated it.....grrgh

Edited November 13, 2010 by triger49

[jaclaz]

Both the 4.10.2226 contained in:

http://download.microsoft.com/download/0/0/a/00a7161e-8da8-4c44-b74e-469d769ce96e/dsclient9x.msi

and the newer 4.10.2228 version contained in:

ftp://ftp.catalyst.com/pub/cstools/support/dsclient.exe

appear like being the "export" version.

I have seen a few references to IE 6 connected with the encryption, maybe there is an updated "non-export" version of SECUR32.DLL in it's install?

Or maybe the trick is in "money"?:

http://articles.techrepublic.com.com/5100-10878_11-5035024.html

Updated Windows 9x Dsclient available

Since the Active Directory client extension’s initial release, Microsoft has discovered a few minor bugs and released an update in the form of a hot fix. You can obtain this update by contacting Microsoft’s Product Support Services by phone. Although a support call to Microsoft usually costs around $200, if you ask the service representative specifically for the update and not technical assistance, he or she will usually waive the charges. Click here for a list of Microsoft Product Support Services phone numbers and rates or here for more information about acquiring the updated Windows 9x Dsclient.

OT, but not much, and JFYI:

http://support.microsoft.com/dllhelp

Mdgx site is back online.

jaclaz

P.S.: What about this one?:

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=7c219dcc-ec00-4c98-ba61-fd98467952a8&displaylang=en

Brief Description

This download includes extensions for the Windows® 95, Windows 98, and Windows NT® 4.0 operating systems that allow those client platforms to take advantage of features provided by the Windows 2000 Active Directory service.

It contains a Windows 2000 version of SECUR32.DLL.

From the .chm inside the download:

Searching for printers in Active Directory

You can locate shared printers in Active Directory from computers running Windows 95, Windows 98, or Windows NT 4.0. To do so, you must install the following software on those computers:

Active Directory client

Microsoft Internet Explorer version 4.01 or later

Service Pack 6a (for computers running Windows NT 4.0)

Edited November 13, 2010 by jaclaz

[triger49]

hi;

Not in the ie6sp1 install, but here is what is "suppose" to be

the none export version 4.10.2228.....

Instant Messaging Client Authentication From Separate Domain

http://support.microsoft.com/kb/q267972/

HTH

Jake

[jaclaz]

Only for the record, here is the stupid unavailable update page:

http://web.archive.org/web/20040302004257/http://support.microsoft.com/?kbid=323466

@triger49

Seemingly the file at:

http://support.microsoft.com/kb/q267972/

http://download.microsoft.com/download/win98/update/9766/w98/en-us/266772usa8.exe

contains two different versions of the "Export" version also, renamed as secur32.98g and secur32.98s

jaclaz

[triger49]

@triger49

Seemingly the file at:

http://support.microsoft.com/kb/q267972/

http://download.microsoft.com/download/win98/update/9766/w98/en-us/266772usa8.exe

contains two different versions of the "Export" version also, renamed as secur32.98g and secur32.98s

jaclaz

Hi Jaclaz;

I saw that, which is why I put in quotes "suppose" to be. I marvel that

a DLL as widely used as this one appears to be is so tough to track

down concrete information on.

Jake

[dencorso]

contains two different versions of the "Export" version also, renamed as secur32.98g and secur32.98s

98g is for the "Gold" edition = Win 98 FE, while 98s is for Win 98 SE.

I've just checked and redownloaded the dsclient.exe, and also Q266772, Q267879 and Q267972... these latter 3 documents lead one to the same 267972USA8.EXE hotfix, containing the same Export Version of secur32.dll, v, 2228, which is also contained in the dsclient. So that leads nowhere. For the what it's worth, if the 128-bit exists, it ought to be marked "US and Canada Only", not "Non-Export" or whatever. By now, i think erpdude8 is right: the 128-bit version is a myth (moreover, if it weren't, probably Gape would have got a copy of it and included it in the uSP, and that never happened).

@triger49: in what regards Win 9x/ME files, curb your marvel, because, by now, almost anything already is tough to track, and it'll get worse...

[jaclaz]

I've just checked and redownloaded the dsclient.exe, and also Q266772, Q267879 and Q267972... these latter 3 documents lead one to the same 267972USA8.EXE hotfix, containing the same Export Version of secur32.dll, v, 2228, which is also contained in the dsclient. So that leads nowhere.

You mean you didn't trust my word for it?

Current question is: would the "other" download and the 2K .dll work on windows 9x?

jaclaz

[PROBLEMCHYLD]

Nevermind erpdude8 already posted.

Edited November 13, 2010 by PROBLEMCHYLD

[triger49]

@triger49: in what regards Win 9x/ME files, curb your marvel, because, by now, almost anything already is tough to track, and it'll get worse...

LOL, aren't you just a ray of sunshine.....seriously tho, look at the big picture.

Right here on msfn, we have MDGX running a virtual Windows National Archive

We have Jaclaz who will earn a place on Wikipedia for his Bookmarks library.

Yourself, you have probably forgotten more than most of us will know about 9x.

Xeno, Tihiy, Rloew literaly reinventing the wheel and showing us what MS$ could

have done. The List goes on and on, erpdude, LLXX, Gape, Maximus-Decim.

The point is, as a rule of thumb somebody around here has "been there, done that"

How this silly little DLL slipped under everybody's radar just amazed me.

Jake

[dencorso]

True enough, Jake! Of course.

[herbalist]

I'm not sure if this is any help or if it confuses the situation even more. On my old 98FE unit, my copy of secur32.dll does not say export version or USA and Canada on the version tab. Just says Microsoft Win32 Security Services.

The MD5 for the file is 677273be08256ea12afdfc8da91ac54a if it's of any help. So far, I'm unable to determine just where I got this file. It does have DUN1.4 installed.

Rick

Edited November 13, 2010 by herbalist