How Windows 98 Processed Network Login Passwords

Microsoft Windows 98 relied on legacy authentication protocols, local password caching, and challenge-response handshakes to authenticate users across a local network. Unlike Windows NT, Windows 98 lacked native kernel-level account security, meaning its login process was primarily designed to unlock local network shares and authenticate against Windows NT domains, LAN Manager servers, or Novell NetWare environments rather than securing the local physical machine.

The Logon Prompt and Password List (.PWL) Files

When a user started Windows 98, the operating system displayed the Client for Microsoft Networks login dialog, prompting for a username, password, and optional Windows NT domain. Windows 98 processed this locally by checking for a Password List file (<username>.pwl) stored in the C:\WINDOWS directory.

The master password entered by the user unlocked this .pwl file, which contained cached credentials for mapped network drives, shared printers, and remote servers. If networking was not connected to an NT Domain, the login dialog acted merely as a gateway to decrypt this credential cache; pressing "Cancel" often bypassed local logon entirely while still allowing access to the desktop.

Password Hashing and the LAN Manager (LM) Protocol

For actual network authentication against another workstation or domain controller, Windows 98 used Server Message Block (SMB) protocols powered primarily by the LAN Manager (LM) authentication algorithm:

  1. Case Conversion and Padding: The system converted the entered password to all uppercase characters and truncated or padded it with null bytes to reach exactly 14 bytes.
  2. Key Splitting: The 14-byte string was split into two separate 7-byte segments.
  3. DES Encryption: Each 7-byte segment was used as a 56-bit key to encrypt a fixed, well-known 8-byte string (KGS!@#$%) using the Data Encryption Standard (DES).
  4. Hash Assembly: The two resulting 8-byte ciphertext blocks were concatenated into a single 16-byte LM hash.

Because the password was converted to uppercase and divided into two independent 7-character halves, the keyspace was drastically reduced, making LM hashes susceptible to brute-force attacks.

Network Handshake: Challenge-Response Authentication

Windows 98 avoided sending plain-text passwords across the local network by default, instead employing a challenge-response mechanism:

  1. Negotiation: The Windows 98 client contacted the target server (such as a Windows NT Server or another peer workstation) to request an authenticated session.
  2. Challenge Nonce: The server generated an 8-byte random challenge string and sent it back to the client.
  3. Response Generation: The client padded its 16-byte LM hash with five null bytes to create a 21-byte string, divided it into three 7-byte keys, and used each key to DES-encrypt the server's 8-byte challenge. The three results formed a 24-byte "LM Response."
  4. Validation: The client transmitted the LM Response to the server. The server, holding the user's LM hash in its Security Accounts Manager (SAM), performed the same calculation. If the results matched, network access was granted.

NTLM and Dial-Up Networking Updates

Although Windows 98 defaulted to the weaker LM protocol, later service releases and the Directory Services Client (DSClient) update enabled Windows 98 to support NTLMv1 (NT LAN Manager). When configured for NTLM, Windows 98 generated a 16-byte MD4 hash of the case-sensitive Unicode password, executing the challenge-response process with the MD4 hash alongside the traditional LM response for backward compatibility.