Questions[windows-2000](server)

We have a legacy product that end users access by connecting to a windows 2000 terminal server on our premises. To circumvent corporate firewall issues on the end user side, we have a Citrix Gateway (which tunnels the RDP traffic over HTTPS), for them to use.

Is it possible to replace the Citrix layer with RD Gateway 2008 (or 2008 R2)?

Specifically I am looking to find out a) Can RD Gateway 2008 can act as the gateway for a Windows 2000 terminal server. b) Can we do this without forcing our users to enter their credentials twice - once for the gateway and again for the Windows 2000 terminal server

Appreciate any insights/comments.

i'm trying to access the shares on a server. The credential box appears, and i enter in a correct username and password, and i get access denied.

The silly thing is that i can Remote Desktop to the server (using the same credentials), and i can check the Security event log for the access denied errors:

Event Type: Failure Audit
Event Source:   Security
Event Category: Account Logon 
Event ID:   681
Date:       3/19/2011
Time:       11:54:39 PM
User:       NT AUTHORITY\SYSTEM
Computer:   STALWART
Description:
The logon to account: Administrator
 by: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0
 from workstation: HARPAX
 failed. The error code was: 3221225578

and

Event Type: Failure Audit
Event Source:   Security
Event Category: Logon/Logoff 
Event ID:   529
Date:       3/19/2011
Time:       11:54:39 PM
User:       NT AUTHORITY\SYSTEM
Computer:   STALWART
Description:
Logon Failure:
    Reason:     Unknown user name or bad password
    User Name:  Administrator
    Domain:     stalwart
    Logon Type: 3
    Logon Process:  NtLmSsp 
    Authentication Package: NTLM
    Workstation Name:   HARPAX 

Looking up the error code (3221225578), i get an article on Technet:

Audit Account Logon Events By Randy Franklin Smith

...

Table 1 - Error Codes for Event ID 681

Error Code  Reason for Logon Failure
3221225578  The username is correct, but the password is wrong.

Which would seem to indicate that the username is correct, but the password is wrong.

i've tried the password many times, uppercase, lowercase, on different user accounts, with and without prefixing the username with servername\username.

What gives that i cannot access the server over file sharing, but i can access it over RDP?

Edit: i tried entering random credentials (i.e. username: ramdom), just to make sure i'm trying to connect to the correct server. The event log on the server shows the failed attempt:

Event Type:   Failure Audit
Event Source: Security
Event Category:   Logon/Logoff 
Event ID: 529
Date:     3/20/2011
Time:     8:40:28 AM
User:     NT AUTHORITY\SYSTEM
Computer: STALWART
Description:
Logon Failure:
  Reason:     Unknown user name or bad password
  User Name:  random
  Domain:     HARPAX
  Logon Type: 3
  Logon Process:  NtLmSsp 
  Authentication Package: NTLM
  Workstation Name:   HARPAX

Edit: Trying all possible LAN Manager Authentication Levels (secpol.msc -> Security Settings -> Local Policies -> Security Options -> LAN Manager Authentication Levels):

• Send LM & NTLM responses: Fails
• Send LM & NTLM - use NTLMv2 session security if negotiated: Fails
• Send NTLM response only (default): Fails
• Send NTLMv2 response only: Fails
• Send NTLMv2 response only\refuse LM: Fails
• Send NTMLv2 response only\refuse LM & NTLM: Fails

(Client: Windows 7. Server: Windows 2000 Server)

My company is (amongst many other things) responsible for a small network with a few servers and about 50 workstations. They want me to help out the current administrator of that network.

The network consists of Windows NT 4.0 and Windows 2000 Servers, the clients are Windows 2000 and Windows XP. The only reason for all the legacy systems is license costs. The network is NATed and the workstations access internet through a (linux) proxy.

The admin seems not to be worried about the security of the network. His argument goes like this:

Windows NT and Windows 2000 have no known vulnerabilities and it's highly unlikely new ones are discovered because no one will put energy into those old systems anyway. Even if there would be a vulnerability it wouldn't be a problem because the workstations don't have a direct connection to the internet.

Can you give me some solid arguments why upgrades to windows versions that are still supported by Microsoft are inevitable from a security standpoint?

If you think the admin is right an I am wrong I also would like to hear about that.

Let's say you have an active directory domain, and you want to have a service account run a certain windows service on multiple machines on the domain. The service account needs to be the same account on all the servers because it needs certain (file access) permissions across all the servers.

The minimum permission you need for this user to be able to run a service is "Log on as a service" permission - in fact, as soon as you go to the Services panel and try to set up a service with a domain user (regardless of what rights they already have, I believe) they automatically get assigned the "Log on as a service" permission.

What I'm trying to to understand is what other rights / permissions this automatically implies;

I'm finding that a service running under a domain account with "Log On As a Service" rights and no other (intentional, at least) rights, is still able to read files on the local file system. Does this mean that I've got a permission inheritance somewhere that I don't know about, or does that mean that "Log on As a Service" also grants some file access or other rights on the server?

I guess another way to ask the question - is there a utility that can tell you, for a given object/user/account, exactly what rights it has and why/where from?

Yes, I know Windows 2000 will run end-of-life in this year, but we still have a lot of Windows 2000 boxes we try to migrate but no idea if all of them can be migrated this year...

Recently I downloaded a new Sysinternals Suite (most recent file date 2010-03-25) and noticed that some tools just do not work on Windows 2000 any longer, which makes troubleshooting a lot harder. I checked all the tools in the suite to check which tools do not work, and dug through to find older versions that do work, but I don't know if there are more recent ones (with fewer bugs) available. I did not find any way to download old versions from Sysinternals website. :-(

So here is my list (re-checked with a fully patched Windows 2000 box):

                            Does not work           Works
    Coreinfo.exe            2.00                    ?
    disk2vhd.exe            1.5.0.0                 ?
    livekd.exe              3.14                    3.0
    procdump.exe            1.72                    ?
    Procmon.exe             2.8 (Frequent crashes)  Filemon/Regmon 7.04
    ShellRunas.exe          1.01                    ?
    vmmap.exe               2.62                    2.2
    ZoomIt.exe              4.1                     1.21

If you know of any more recent versions (preferrably with download links) that work on Windows 2000, or an official download link for older versions, it would be highly appreciated.