ACLUI.DLL

Stephen · Post by **Stephen** » 2005-01-27 19:37

Guys,

I have downloaded UltraVNC 19.5 and installed it on a NT box with SP6a. When I open the Admin Properties and select Configure MS Logon Groups, I get an error message that the system could not locate the ACLUI.DLL. When I try to connect to this NT box remotely, I get errors regarding AUTHSSP.DLL and SECUR32.DLL. Do you have any idea? Thanks in advance...

Stephen

Guest · Post by **Guest** » 2005-01-28 09:18

Stephen,

Regarding aclui.dll, you need to install the security configuration manager.
This is mentioned in the documentation.

AuthSSP.dll should be in the UltraVNC installation dir, this dll implements the MS-Logon II functionality.

Regarding Secur32.dll, I'm a little bit confused because on NT4 security.dll should be used.
I'll change the code to make sure the correct dll is activated.

Martin

Marscha · Post by **Marscha** » 2005-01-28 09:21

previous post was from me.

Martin

Stephen · Post by **Stephen** » 2005-01-28 11:02

Martin,

Sorry for not reading the entire document. I installed the Security Configuration Manager and the error message for ACLUI.DLL disappeared, but the message for SECUR32.DLL continues...I will wait for the code change.

Thanks for all,

Stephen

Marscha · Post by **Marscha** » 2005-01-31 08:42

Stephen,

I changed the code for loading of security.dll / secur32.dll.
No longer try to identify the OS and then load appropriate dll.
Just load secur32.dll which is required on all OSes except NT4.
If this fails, load security.dll.

Code is in CVS, binary will be included in the next RC.

Martin

prandal · Post by **prandal** » 2005-02-07 14:10

Martin,

This still doesn't work with Rudi's latest pre-RC197 winvnc.exe builds. Should it?

Phil

Marscha · Post by **Marscha** » 2005-02-08 08:16

Phil,

The loading of security.dll/secur32.dll does not appear in winvnc.exe but in authSSP.dll.
Is implemented in http://gotovnc.dynalias.com/RC197/authSSP.dll
You should be able to authenticate on NT4. You can configure groups with the MSLogonACL tool.

If you want to configure groups in the UltraVNC Admin Properties page, you need the security configuration manager istalled in order to have the nice User Interface available.

What is the exact error message and what's not working?

Martin

prandal · Post by **prandal** » 2005-02-08 09:48

Martin,

It still complains that it wants secur32.dll and doesn't authenticate, even with the latest AuthSSP.dll.

Sorry I wasn't clear about that,

Phil

Marscha · Post by **Marscha** » 2005-02-09 09:54

Phil,

finally found the problem

. I always focused on the wrong spot...
I implicitly used ImpersonateSecurityContext/RevertSecurityContext with secur32.dll.
Uploaded the change to CVS, binary available with next RC.

Martin

prandal · Post by **prandal** » 2005-02-09 13:55

Excellent!

Post by **Rudi De Vos** » 2005-02-13 21:25

http://www.uvnc.com/RC197/12_02_2005
Contain latest cvs, including the new mslogon dll

prandal · Post by **prandal** » 2005-02-14 13:18

Well, almost there, but...

No more secur32.dll warnings but it still will not authenticate.

hhetzel · Post by **hhetzel** » 2005-02-15 07:02

Same here, too.
I installed Windows NT4 in VMware 4.5.2, added SP6a, Internet Explorer 6 an Security Configuration Manager. My NT4 Workstation (German Language) is Member of an Windows NT4 Domain (all Domain Controllers are NT4 Server - English Language). I installed UltraVNC RC19.6 and added Rudi's RC19.7 build 2005-02-12.
The old mslogon is working (but authentication lasts about 10 seconds), when I use new MS logon I get "VNC authentication failed" without delay.
I tested with Domain Accounts - even one who only belongs to the groups "Domain Users" and "N15S_VNC_full" - and with the local Account "Administrator". I tried to give only the username or domain\username or username@domain. Nothing works.
mslogon.log shows "Invalid attempt (not authenticated) from client <IP> using <user> account."

prandal · Post by **prandal** » 2005-02-15 09:44

Phew, glad it's not just me.

Phil

Marscha · Post by **Marscha** » 2005-02-15 17:32

I set up a NT4 box and could verify the problem.
With just the username I got "not authenticated", with domain\username I got "not authorized".
Finally found the bug and fixed it.
I uploaded the change to cvs.
I'll ask Rudi to update RC197 with a test dll with debug logging.

You need to specify "domain\user" or "machine\user".
Just the username will fail. UPNs fail also.

Please verify that this is working.
Then I could add code to prepend the machine name in case only the username is specified.

(Rename authSSP_NT4.dll to authSSP.dll and copy it to the UltraVNC install dir.
Logging goes to %WINNT%\system32\WinVNC-authSSP_NT.log and %WINNT%\system32\WinVNC-authSSP.log).

Post by **Rudi De Vos** » 2005-02-15 21:50

dll in
http://www.uvnc.com/RC197/12_02_2005/

hhetzel · Post by **hhetzel** » 2005-02-16 10:03

That's it!

"domain\user" or "machine\user" is working for me with authSSP_NT4.dll.

It would be nice to assume first "machine\" if only username is specified, and as a second try if there is no local account "user" to assume "domain\". Maybe it's possible to use the registry-value "CachePrimaryDomain" in "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"...

Great Work! Keep on movin'

prandal · Post by **prandal** » 2005-02-16 10:44

hhetzel wrote:That's it!

"domain\user" or "machine\user" is working for me with authSSP_NT4.dll.

It would be nice to assume first "machine" if only username is specified, and as a second try if there is no local account "user" to assume "domain". Maybe it's possible to use the registry-value "CachePrimaryDomain" in "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"...

Great Work! Keep on movin'

Works here too. I'll second the request for "Domain guessing" too. You do it somehow on Win 2000 and above, and the old MSLogon works without a domain prefix. Having to put a domain prefix in to connect to an NT4 box is going to confuse the hell out of people.

Marscha · Post by **Marscha** » 2005-02-16 11:04

On Windows 2000 the guessing of machine/domain is done by Windows.
I'll try to mimic that behavior on NT.

Marscha · Post by **Marscha** » 2005-03-08 17:30

Done,

see [topic=2188][/topic]