Secunia

Sumit Siddharth has reported a weakness in Microsoft Windows, which can be exploited by malicious people to identify valid user accounts.

Active Directory allows "Logon Hours" to be set for a user, which results in a different error message being returned when attempting to log on during a period that is set as "Logon Denied".

The weakness is reported in Microsoft Windows Server 2003 Standard Edition. Other versions may also be affected.

Solution
A security fix will reportedly not be issued, but will be considered in the next version or service pack.

Provided and/or discovered by
Sumit Siddharth

Changelog
Further details available in Customer Area

Original Advisory
http://www.notsosecure.com/folder2/2007/05/27/logon-time-restrictions-in-a-domain-in-windows-server-2003-allows-username-enumeration/

Deep Links
Links available in Customer Area