[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Windows 2003 SP1, cross-domain trust

Did you use ktpass /MITRealmName HEIMDALREAM.COM /trustencryp rc4 on the DC 
to set the trust to rc4 ?


----- Original Message ----- 
From: "Chris Stromsoe" <cbs@cts.ucla.edu>
To: <heimdal-discuss@sics.se>; "Björn Sandell" <biorn@chalmers.se>
Sent: Thursday, March 29, 2007 9:49 PM
Subject: Re: Windows 2003 SP1, cross-domain trust

On Thu, 29 Mar 2007, Björn Sandell wrote:

> I disabled everything but the des keys on the cross realm principal:
> Keytypes(salttype[(salt-value)]): des-cbc-md4(pw-salt), 
> des-cbc-crc(pw-salt)
> It's working for XP clients but not for w2k client; though I suspect
> that the w2k clients can't handle pkinit.

I had des-cbc-crc and arcfour-hmac-md5 keytypes.  I removed the
arcfour-hmac and it started working.  That would seem to indicate that
Windows 2003 doesn't do RC4-HMAC for the cross-realm principal.  I've
tested direct logins to the DC and to W2K3 and XP clients and had no
problems.  Thanks.