Registering Subauthentication Packages
Each Subauthentication DLL is assigned a DLL number in the range zero through 255. The DLL number is used to associate the subsystem calling LsaLogonUser with the appropriate Subauthentication DLL. DLL number zero is reserved for the Domain Controller SubAuthentication Filter. This DLL allows the package to do additional password or logon validation on a domain controller in addition to that normally done by the MSV1_0 or Kerberos packages. DLL numbers 1 through 127 are reserved Microsoft DLL numbers. Numbers 128 through 254 are available to independent software vendors. Software vendors can be assigned a DLL number by Microsoft by sending e-mail to subauth@microsoft.com. Registering a subauthentication package with Microsoft prevents conflict between package IDs when multiple subauthentication packages are installed on a system.
Microsoft will not assign the value of 255 for any subauthentication DLL. If you are developing a subauthentication DLL for use only within your company or facility, subauthentication number 255 is recommended. In this case, it is not necessary to obtain a subauthentication DLL number from Microsoft.
After you have a DLL number, you can register the DLL under the related authentication package's registry key.
The registry location for MSV1_0 subauthentication packages is:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0
The registry location for Kerberos subauthentication packages is:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos
If the required key does not exist, you must create it. Under that key, create a registry value named 'AuthN' where 'N' is the DLL number (for example, Auth255).
The 'AuthN' registry value holds REG_SZ data and must specify the name of the subauthentication package DLL. The DLL must be in the default DLL load path.
The authentication package loads the named DLL the first time the subauthentication package is requested.
Send comments about this topic to Microsoft
Build date: 4/6/2010