MS04-011 (QFE Q835732) breaks auto logon

[Doug Hoeffel]

I am testing the deployment of MS04-011 with DUA and EWF. All seems to be
well with the file and registry updates (I only need 6 of the files in the
hotfix... gdi32.dll, lsasrv.dll, msasn1.dll, msgina.dll, netapi32.dll, and
schannel.dll), but the issue I noticed is that auto logon gets broke. The
registry values AutoAdminLogon and ForceAutoLogon are both 1 as I expect,
and the DefaultPassword is correct. The issue is the DefaultUserName value
gets cleared which breaks auto logon.

Has anyone seen this problem, or had total success in getting this hotfix to
install without breaking anything?

TIA... Doug

 

[Mario]

I applied this update to about 1K terminals on the field...
I have noticed no problems.

this files are shipped by my update:
//**************************************************************************
**********************************************
//** 2 - Q835732 - April 2004, Microsoft Security Bulletin QFE MS04-011
could impact remote code execution **
//**************************************************************************
**********************************************
//**************************************************************************
**********************************************
//** Files to copy: destination: **
//** **
//** 835732_gdi32.dll C:\WINDOWS\system32\gdi32.dll
**
//** 835732_h323.tsp C:\WINDOWS\system32\h323.tsp **
//** 835732_h323msp.dll C:\WINDOWS\system32\h323msp.dll **
//** 835732_ipnathlp.dll C:\WINDOWS\system32\ipnathlp.dll **
//** 835732_lsasrv.dll C:\WINDOWS\system32\lsasrv.dll
**
//** 835732_msasn1.dll C:\WINDOWS\system32\msasn1.dll
**
//** 835732_msgina.dll C:\WINDOWS\system32\msgina.dll
**
//** 835732_netapi32.dll C:\WINDOWS\system32\netapi32.dll
**
//** 835732_schannel.dll C:\WINDOWS\system32\schannel.dll


best regards,
Mario

 

[Doug Hoeffel]

Thanks Mario!

Another question... is your system set up for auto logon? If so, did it get
broke after applying the patch?

TIA... Doug

 

[Mario]

Hi Doug

Yes my system is set up for autologon....(administrator)...

As I told, there are no problems...
And if there are problems, I would know that, because I shipped my update
only to about 1K Terminals and our customers are very sensitive on errors
;-)

Mario

 

[Doug Hoeffel]

Mario:

Well, this is getting interesting. I rebuilt my box, applied my MS04-011
patch via DUA again, and the same thing happended. I saved the Winlogon
registry key before I applied MS04-011 and compared it to after I loaded the
patch. There were no differences.

Also, my earlier statement that DefaultUserName gets cleared is not correct.
That field is blank before and after I apply MS04-011. I guess I don't
understand how auto logon works since everything in the Winlogon key looks
ok. If I set DefaultUserName
correctly then this fixes it but I'm bothered by the fact that I don't
understand how it gets broke.

Just curious... whats in your image. I use XPe SP1 with EWF, Explorer
Shell, Friendly Logon User I/F, Automatic Logon, etc.

TIA ... Doug

 

[Doug Hoeffel]

Well... I think the issue is that the DefaultUserName field should NOT be
blank. I kinda always wondered how auto logon worked on my XPe image when
this field was blank. I have another product based on XP Pro SP1 that uses
auto logon but not as Adminstrator and the DefaultUserName field was not
blank and the MS supplied MS04-011 hotfix works just fine.

Maybe this will help someone...
.... Doug
....

 

[KM]

Doug,

If you are talking about DefaultUserName filed. How could it be blank?
I mean you cannot create a user account under XP with a blank name. Therefore, if you have it blank, there is nothing to autologon
to.

 

[Doug Hoeffel]

KM:

I agree. I'm just reporting what I'm seeing. I build my XPe SP1 image with
AutoLogon and the DefaultUserName field is blank. Maybe auto logon works
because AltDefaultUserName is used? And, maybe the new msgina.dll in
MS04-011 enforces that DefaultUserName cannot be blank?

.... Doug

Doug,

If you are talking about DefaultUserName filed. How could it be blank?
I mean you cannot create a user account under XP with a blank name.

Therefore, if you have it blank, there is nothing to autologon

 

[KM]

Doug,

Frankly I have never been sure how AltDefaultUserName gets used. The
XP/msgina seems to have a reference to the value but I don't know how it
uses the value.
From security point of view it could be that msgina does not allow the
DefaultUserName to be blank.

KM