With Encryption Required You Can Still Select PAP, SPAP, or CHAP

ID: Q227815

The information in this article applies to:
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Server

SYMPTOMS

When you configure a Dial-Up Networking connection to require data encryption, you may be able to select Password Authentication Protocol (PAP), Shiva Password Authentication Protocol (SPAP), or Challenge Handshake Authentication Protocol (CHAP), even though these protocols do not support data encryption.


STATUS

Microsoft has confirmed this to be a problem in Windows 2000.


MORE INFORMATION

To configure the Advanced Security Settings of a Dial-Up Networking connection, follow these steps:

  1. Right-click the Dial-Up Networking connection, and then click Properties.


  2. On the Security tab, click Advanced (Custom Settings), and then click Settings.


  3. In the Data Encryption box, click Require encryption(disconnect if server declines).


  4. Under Logon Security, click to select the check boxes for the protocols you want to use, and then click OK.


When you click Require encryption(disconnect if server declines), you may click to select the Unencrypted Password (PAP), Shiva Password Authentication Protocol (SPAP), or Challenge Handshake Authentication Protocol (CHAP) check boxes, even though these protocols do not require encryption. In addition, you are required to select at least one of the MS-CHAP protocols or the Extensible Authentication Protocol (EAP).

If you do not select a version of MS-CHAP or EAP, you receive the following error message:
The current encryption selection requires EAP or some version of MS-CHAP logon security methods.


If you select at least one version of MS-CHAP in addition to PAP, SPAP, or CHAP, you receive the following error message:
The protocols you have selected include PAP, SPAP and/or CHAP. If one of these is negotiated, data encryption will not occur. Do you want to keep these settings?
If you click Yes, the connection does not use PAP, SPAP, or CHAP. Since data encryption is required, the connection uses only the versions of MS-CHAP you selected.

Additional query words:

Keywords : kbenv kberrmsg kbnetwork ntsecurity
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbprb


Last Reviewed: December 29, 1999
© 2000 Microsoft Corporation. All rights reserved. Terms of Use.