• This update will now correctly detect when a computer that is running Windows Server 2003 Service Pack 2 (SP2) is in an installation where IIS 6 contains some Windows Server 2003 Service Pack 1 (SP1) binaries, and will refuse to install and exits with an error code. The versions of update 973917 that were released before this date will successfully install, but they could cause IIS to not restart after installation.
• On a computer that is running Windows Server 2003, this rerelease addresses an issue that could cause excessive amounts of memory to be allocated upon enabling Extended Protection for Authentication.
• On a computer that is running Windows Server 2008, this rerelease addresses an issue that could cause Extended Protection not to function correctly when IIS is configured to use kernel-mode Windows Authentication.

Back to the top

Configuration

• Channel binding information that is specified through a Channel Binding Token (CBT). This is used primarily for SSL connections.
• Service binding information that is specified through a service principal name (SPN). This is used primarily for connections that do not use SSL or when a connection is established. For example, this might be in a scenario in which SSL is offloaded to another device, such as a proxy server or load-balancer.

Back to the top

Extended Protection Scenarios

• In these scenarios, you could also specify the AllowDotlessSpn flag if your networking environment supports NetBIOS-based SPNs. However, NetBIOS-based SPNs are not secure.
• For the scenarios in which SPN checking will be used, and channel binding token checking will not be used, you should not specify the NoServiceNameCheck flag.
• Default installation of IIS 6.0, IIS 7.0, or IIS 7.5 does not enable or install Windows authentication. Extended Protection is applicable only when Windows authentication is enabled for your Web site or application.

Back to the top

Configuration on IIS 7.0 and 7.5

<windowsAuthentication enabled="false" />

How to enable Extended Protection for Windows authentication for IIS 7.5

1. Click Start, point to Administrative Tools, and then click Internet Information Services (IIS) Manager.
2. In the Connections pane, expand the server name, expand Sites, and then select the site, application or Web service for which you want to enable Extended Protection for Windows authentication.
3. Scroll to the Security section in the Home pane, and then double-click Authentication.
4. In the Authentication pane, select Windows Authentication.
5. Click Enable in the Actions pane.
6. Click Advanced Settings in the Actions pane.
7. When the Advanced Settings dialog box appears, select one of the following options in the Extended Protection menu:
   • Select Accept if you want to enable extended protection while providing down-level support for clients that do not support extended protection.
   • Select Required if you want to enable extended protection without providing down-level support.
8. Click OK to close the Advanced Settings dialog box.

How to enable Extended Protection for Windows authentication for IIS 7.0

Configuration

Attribute

Child Elements

Configuration Sample

<location path="Default Web Site">
   <system.webServer>
      <security>
         <authentication>
            <windowsAuthentication enabled="true">
               <extendedProtection tokenChecking="Allow" flags="None">
                  <spn name="HTTP/www.contoso.com" />
                  <spn name="HTTP/contoso.com" />
               </extendedProtection>
            </windowsAuthentication>
         </authentication>
      </security>
   </system.webServer>
</location>

Sample Code

AppCmd.exe

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /enabled:"True" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /extendedProtection.tokenChecking:"Allow" /extendedProtection.flags:"None" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /+"extendedProtection.[name='HTTP/www.contoso.com']" /commit:apphost

appcmd.exe set config "Default Web Site" -section:system.webServer/security/authentication/windowsAuthentication /+"extendedProtection.[name='HTTP/contoso.com']" /commit:apphost

C#

using System;
using System.Text;
using Microsoft.Web.Administration;

internal static class Sample
{
   private static void Main()
   {
      using (ServerManager serverManager = new ServerManager())
      {
         Configuration config = serverManager.GetApplicationHostConfiguration();

         ConfigurationSection windowsAuthenticationSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication", "Default Web Site");
         windowsAuthenticationSection["enabled"] = true;

         ConfigurationElement extendedProtectionElement = windowsAuthenticationSection.GetChildElement("extendedProtection");
         extendedProtectionElement["tokenChecking"] = @"Allow";
         extendedProtectionElement["flags"] = @"None";

         ConfigurationElementCollection extendedProtectionCollection = extendedProtectionElement.GetCollection();

         ConfigurationElement spnElement = extendedProtectionCollection.CreateElement("spn");
         spnElement["name"] = @"HTTP/www.contoso.com";
         extendedProtectionCollection.Add(spnElement);

         ConfigurationElement spnElement1 = extendedProtectionCollection.CreateElement("spn");
         spnElement1["name"] = @"HTTP/contoso.com";
         extendedProtectionCollection.Add(spnElement1);

         serverManager.CommitChanges();
      }
   }
}

Visual Basic .NET

Imports System
Imports System.Text
Imports Microsoft.Web.Administration
Module Sample
   Sub Main()
      Dim serverManager As ServerManager = New ServerManager
      Dim config As Configuration = serverManager.GetApplicationHostConfiguration

      Dim windowsAuthenticationSection As ConfigurationSection = config.GetSection("system.webServer/security/authentication/windowsAuthentication", "Default Web Site")
      windowsAuthenticationSection("enabled") = True

      Dim extendedProtectionElement As ConfigurationElement = windowsAuthenticationSection.GetChildElement("extendedProtection")
      extendedProtectionElement("tokenChecking") = "Allow"
      extendedProtectionElement("flags") = "None"

      Dim extendedProtectionCollection As ConfigurationElementCollection = extendedProtectionElement.GetCollection

      Dim spnElement As ConfigurationElement = extendedProtectionCollection.CreateElement("spn")
      spnElement("name") = "HTTP/www.contoso.com"
      extendedProtectionCollection.Add(spnElement)

      Dim spnElement1 As ConfigurationElement = extendedProtectionCollection.CreateElement("spn")
      spnElement1("name") = "HTTP/contoso.com"
      extendedProtectionCollection.Add(spnElement1)

      serverManager.CommitChanges()
   End Sub
End Module

JavaScript

var adminManager = new ActiveXObject('Microsoft.ApplicationHost.WritableAdminManager');
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST";

var windowsAuthenticationSection = adminManager.GetAdminSection("system.webServer/security/authentication/windowsAuthentication", "MACHINE/WEBROOT/APPHOST/Default Web Site");
windowsAuthenticationSection.Properties.Item("enabled").Value = true;

var extendedProtectionElement = windowsAuthenticationSection.ChildElements.Item("extendedProtection");
extendedProtectionElement.Properties.Item("tokenChecking").Value = "Allow";
extendedProtectionElement.Properties.Item("flags").Value = "None";

var extendedProtectionCollection = extendedProtectionElement.Collection;

var spnElement = extendedProtectionCollection.CreateNewElement("spn");
spnElement.Properties.Item("name").Value = "HTTP/www.contoso.com";
extendedProtectionCollection.AddElement(spnElement);

var spnElement1 = extendedProtectionCollection.CreateNewElement("spn");
spnElement1.Properties.Item("name").Value = "HTTP/contoso.com";
extendedProtectionCollection.AddElement(spnElement1);

adminManager.CommitChanges();

VBScript

Set adminManager = createObject("Microsoft.ApplicationHost.WritableAdminManager")
adminManager.CommitPath = "MACHINE/WEBROOT/APPHOST"

Set windowsAuthenticationSection = adminManager.GetAdminSection("system.webServer/security/authentication/windowsAuthentication", "MACHINE/WEBROOT/APPHOST/Default Web Site")
windowsAuthenticationSection.Properties.Item("enabled").Value = True

Set extendedProtectionElement = windowsAuthenticationSection.ChildElements.Item("extendedProtection")
extendedProtectionElement.Properties.Item("tokenChecking").Value = "Allow"
extendedProtectionElement.Properties.Item("flags").Value = "None"

Set extendedProtectionCollection = extendedProtectionElement.Collection

Set spnElement = extendedProtectionCollection.CreateNewElement("spn")
spnElement.Properties.Item("name").Value = "HTTP/www.contoso.com"
extendedProtectionCollection.AddElement(spnElement)

Set spnElement1 = extendedProtectionCollection.CreateNewElement("spn")
spnElement1.Properties.Item("name").Value = "HTTP/contoso.com"
extendedProtectionCollection.AddElement(spnElement1)

adminManager.CommitChanges()

Back to the top

Configuration on IIS 6.0

1. Start Registry Editor. To do this, click Start, click Run, type regedit, and then click OK.
2. Locate and then click the following registry subkey:
   
   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W3SVC\Parameters\extendedProtection\
3. Verify that the tokenChecking, Flags, and spns registry values are present.
   
   If these registry values are not present, follow these steps to create them:
   1. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click DWORD Value.
   2. Type tokenChecking, and then press ENTER.
   3. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click DWORD Value.
   4. Type flags, and then press ENTER.
   5. Select the registry subkey that is listed in step 2, point to New on the Edit menu, and then click MULTI_SZ Value.
   6. Type spns, and then press ENTER.
4. Click to select the tokenChecking registry value.
5. On the Edit menu, click Modify.
6. In the Value data box, type the preferred value, and then click OK.
7. Click to select the flags registry value.
8. In the Value data box, type the preferred value, and then click OK.
9. Click to select the spns registry value.
10. In the Value data box, enter an appropriate spn, and then click OK.
11. Exit Registry Editor.

Back to the top

Update information

Back to the top

Prerequisites for Windows Server 2003

Known issues

• Windows Server 2003
  
  This update was rereleased on March 9, 2010 to perform an additional check to make sure that the IIS 6 system on a computer that is running Windows Server 2003 SP2 does not contain binaries from the SP1 version. If such binaries are found, this update will exit with an error message. To fix this condition, reapply the SP2 update to your computers and install this package after you successfully reinstall SP2.
  
  The original version of this security update, released before March 9, 2010, could cause IIS application pools to not start on installations of Windows Server 2003 SP2 where IIS 6 may contain some SP1 binaries, IIS application pools may not start. The System log would display the following error message when the IIS service is started:
  Event ID 1009, Description: A process serving application pool 'DefaultAppPool' terminated unexpectedly. The process id was '1234'
  For more information about this known issue, click the following article number to view the article in the Microsoft Knowledge Base:
  2009746  (http://kbalertz.com/Feedback.aspx?kbNumber=2009746/ ) Internet Information Services 6.0 may not function correctly after installing KB973917
  We recommend reviewing the "Prerequisites for Windows Server 2003" section if your computer is not a clean Windows Server 2003 SP2 installation.
  
  As of December 16, 2009, if you use Automatic Updates, you will no longer be offered this update if your IIS installation is in a configuration where both SP1 and SP2 binaries are present on the computer. We recommend that you review the following article in the Microsoft Knowledge Base for the next steps that you must take to make sure that the computer is ready to apply this update.
  2009746  (http://kbalertz.com/Feedback.aspx?kbNumber=2009746/ ) Internet Information Services 6.0 may not function correctly after installing KB973917
• Windows Server 2003 and Windows Server 2008
  
  This update was re-released on March 9, 2010. This re-released update fully replaces the initial release. If you install the new release, the initial release will be uninstalled and replaced by the new one. Uninstalling the March 9 release of this update will leave the computer without Extended Protection for IIS functionality present.

Back to the top

How to obtain this update

For Windows Server 2003

For Itanium-based versions of Windows Server 2003

For x64-based versions of Windows Server 2003 and for Windows XP x64 edition

For Windows Server 2008

For Itanium-based versions of Windows Server 2008

For x64-based versions of Windows Server 2008

For Windows Vista

For x64-based versions of Windows Vista

Back to the top

Back to the top

Windows XP and Windows Server 2003 file information

• The files that apply to a specific milestone (RTM, SPn) and service branch (QFE, GDR) are noted in the "SP requirement" and "Service branch" columns.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. QFE service branches contain hotfixes in addition to widely released fixes.
• In addition to the files that are listed in these tables, this software update also installs an associated security catalog file (KBnumber.cat) that is signed with a Microsoft digital signature.

For all supported x64-based versions of Windows Server 2003 and for Windows XP Professional x64 edition

For all supported x86-based versions of Windows Server 2003

For all supported IA-64-based versions of Windows Server 2003

Back to the top

Windows Vista and Windows Server 2008 file information

• The files that apply to a specific product, milestone (RTM, SPn), and service branch (LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
  Collapse this tableExpand this table

  Version	Product	Milestone	Service branch
  6.0.6000.16xxx	Windows Vista	RTM	GDR
  6.0.6000.20xxx	Windows Vista	RTM	LDR
  6.0.6001.18xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	GDR
  6.0.6001.22xxx	Windows Vista SP1 and Windows Server 2008 SP1	SP1	LDR
  6.0.6002.18xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	GDR
  6.0.6002.22xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	LDR

• Service Pack 1 is integrated into the release version of Windows Server 2008. Therefore, RTM milestone files apply only to Windows Vista. RTM milestone files have a 6.0.0000. xxxxxx version number.
• GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.
• The MANIFEST files (.manifest) and the MUM files (.mum) that are installed for each environment are listed separately. MUM and MANIFEST files, and the associated security catalog (.cat) files, are critical to maintaining the state of the updated component. The security catalog files (attributes not listed) are signed with a Microsoft digital signature.

For all supported x86-based versions of Windows Vista and Windows Server 2008

For all supported x64-based versions of Windows Vista and Windows Server 2008

For all supported IA-64-based versions of Windows Server 2008