Windows 98 LAN Domain Controller Integration

This article explores how Microsoft Windows 98 communicated with local area network (LAN) domain controllers to provide network authentication, resource access, and centralized management. Built on a hybrid 16-bit/32-bit architecture without a native Windows NT security subsystem, Windows 98 relied on specialized network clients, legacy protocols, and pass-through authentication to participate in Windows NT and early Active Directory enterprise environments.

The Client Architecture

Windows 98 handled domain integration through a networking component called the Client for Microsoft Networks. Unlike Windows NT Workstation, Windows 98 lacked a local Security Accounts Manager (SAM) database and did not enforce local file-level permissions or secure local logins.

To connect to a domain, administrators configured the client properties to "Log on to Windows NT domain" and specified the target domain name. The system used Server Message Block (SMB) file sharing protocols operating over NetBIOS. While NetBIOS over TCP/IP (NetBT) was the enterprise standard, Windows 98 could also communicate with domain controllers using NetBEUI or IPX/SPX protocols.

Domain Authentication Process

When a user logged into a Windows 98 machine assigned to a domain, the authentication workflow functioned as follows:

  1. Broadcast and Discovery: Windows 98 discovered the domain controller by broadcasting a NetBIOS name query or by querying a Windows Internet Name Service (WINS) server or LMHOSTS file to resolve the domain's <1Ch> NetBIOS name record. This returned the IP addresses of available Primary Domain Controllers (PDCs) and Backup Domain Controllers (BDCs).
  2. Credential Exchange: The client initiated a session setup request to the domain controller over NetBIOS/SMB port 139.
  3. NTLM Authentication: Windows 98 used legacy LAN Manager (LM) and NTLMv1 challenge-response mechanisms. The domain controller issued an 8-byte challenge, and Windows 98 encrypted this challenge using the hash of the user’s password before sending it back.
  4. Validation: The PDC or BDC validated the response against its centralized account database and returned a success or failure packet to the client.

Because Windows 98 did not have a local security subsystem, failing the domain login or clicking "Cancel" at the login prompt still granted the user access to the local desktop. However, the user was denied access to domain-secured network resources.

Logon Scripts and Policy Enforcement

Once authenticated, Windows 98 interacted with domain controllers to apply central management settings:

  • Logon Scripts: The client accessed the domain controller’s NETLOGON share to execute assigned batch files (.bat or .cmd). These scripts automated network drive mappings (NET USE) and printer connections.
  • System Policies: Windows 98 supported central policy management via the System Policy Editor (poledit.exe). During logon, the client downloaded a system policy file named CONFIG.POL from the domain controller's NETLOGON share. Windows 98 merged these directives into its local registry (USER.DAT and SYSTEM.DAT) to disable specific interface elements, lock down Control Panel applets, and restrict executable access.

Transition to Active Directory

With the release of Windows 2000 Server, domain environments shifted from Windows NT domains to Active Directory, introducing Kerberos authentication, LDAP querying, and DNS-based service location.

Windows 98 could not natively interact with these new features and defaulted to down-level NT 4.0 compatibility modes. To address this, Microsoft released the Active Directory Client Extension (DSClient) for Windows 98. Installing DSClient allowed Windows 98 to:

  • Use DNS instead of NetBIOS to locate domain controllers.
  • Support NTLMv2 authentication, mitigating vulnerabilities inherent to LM and NTLMv1.
  • Query Active Directory objects using an Active Directory Service Interfaces (ADSI) runtime.

Despite these updates, Windows 98 never supported native Kerberos authentication or modern Active Directory Group Policies (GPOs), relying entirely on NTLM and legacy policy files throughout its lifecycle.