DOCUMENT:Q230681
TITLE   :RAS Credentials Cached When "Save Password" Option Cleared
PRODUCT :Windows NT
PROD/VER:4.0
OPER/SYS:WINDOWS NT
KEYWORD :kbbug4.00 kbfix4.00 

-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4 
 - Microsoft Windows NT Server versions 4.0, 4.0 SP1, 4.0 SP2, 4.0 SP3, 4.0 SP4 
 - Microsoft Windows NT Server, Enterprise Edition versions 4.0, 4.0 SP4 
-------------------------------------------------------------------------------

SYMPTOMS
========

When you clear the Save password check box on the logon credentials screen of a
computer that uses the Microsoft Dial-Up Networking client software to connect
to a Microsoft Remote Access Server (RAS) server, the user ID, password, and
domain names are still cached in the server's registry.

RESOLUTION
==========

A supported fix that corrects this problem is now available from Microsoft, but
has not been fully regression tested and should be applied only to systems
determined to be at risk of attack. Please evaluate your system's physical
accessibility, network and Internet connectivity, and other factors to determine
the degree of risk to your system. If your system is sufficiently at risk,
Microsoft recommends you apply this fix. Otherwise, wait for the next Windows NT
4.0 service pack that contains this fix.

To resolve this problem immediately, contact Microsoft Product Support Services
to obtain the fix. For a complete list of Microsoft Product Support Services
phone numbers and information on support costs, please go to the following
address on the World Wide Web:

   http://support.microsoft.com/support/supportnet/default.asp

The English version of this fix should have the following file attributes or
later:

   Date      Time      Size      File name      Platform
   -----------------------------------------------------
   05/06/99  04:38p    127,248   Rasapi32.dll   (x86)
   04/28/99  05:58p    346,896   Rasdlg.dll     (x86)

   05/06/99  04:37p    198,416   Rasapi32.dll   (Alpha)
   04/28/99  05:46p    510,224   Rasdlg.dll     (Alpha)

This hotfix has been posted to the following Internet location as Pwdfixi.exe
(x86) and Pwdfixa.exe (Alpha):

   ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/nt40/
   Hotfixes-PostSP5/RASPassword-fix/

NOTE: If this product was already installed on your computer when you purchased
it from the Original Equipment Manufacturer (OEM) and you need this fix, please
call the Pay Per Incident number listed on the above Web site. If you contact
Microsoft to obtain this fix, and if it is determined that you only require the
fix you requested, no fee will be charged. However, if you request additional
technical support, and if your no-charge technical support period has expired,
or if you are not eligible for standard no-charge technical support, you may be
charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the
following article in the Microsoft Knowledge Base:

   Q154871 Determining If You Are Eligible for No-Charge Technical Support

STATUS
======

Microsoft has confirmed this problem could result in some degree of security
vulnerability in Windows NT 4.0.

MORE INFORMATION
================

For information on this problem in the Microsoft Routing and Remote Access
Server (RRAS) client, please see the following article in the Microsoft
Knowledge Base:

   Q233303 RRAS Credentials Cached when "Save Password" Option Cleared

Cached security credentials, including passwords, are stored in the registry and
protected by an access control list (ACL). RAS uses Local Security Authority
(LSA) Secrets to store the entries. The default ACL values only allow
administrators and the user associated with the credentials to gain access to
these registry entries.

Additional encryption for LSA Secrets is available to provide protection for this
information when stored on backup tapes, the Emergency Repair Disk, or other
registry backups using the System Key option. For information on System Key
(Syskey.exe) functionality, please refer to the following article in the
Microsoft Knowledge Base:

   Q143475 Windows NT System Key Permits Strong Encryption of the SAM

For additional security-related information about Microsoft products, please
visit the following Microsoft Web site:

   http://www.microsoft.com/security/

Additional query words: 
============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.