The Cryptographic Time Bomb in Microsoft's Networking Past

When Microsoft shipped LAN Manager 2.0 in 1990, they accidentally planted a password expiration time bomb that would render fresh installations completely unusable after September 10, 1990—just as customers finally received the software. This revelation comes from forensic examination of recently rediscovered original disk images analyzed by the OS/2 Museum, exposing one of Microsoft's most spectacular enterprise misfires.

The Phantom Release

Microsoft's LAN Manager 2.0 existed in limbo between June and August 1990. Forensic evidence shows:

  • Final builds compiled June 28, 1990
  • Dependency on OS/2 1.21 (unavailable until August)
  • Shrink-wrap release strategy that alienated OEM partner 3Com
  • Press release ambiguity about August "release" timing

"Files dated after June 1990 are typically version 2.0"
– Microsoft's own MS-DOS 5.0 readme

Versioning Chaos: CSD Archaeology

Without built-in version commands (NET VER arrived in 2.1), administrators relied on cryptic LANMAN.CSD files:

; June 1990 build
CSD = 0
BUILDDATE = 06-28-1990

; November 1990 build
CSD = 2
BUILD = 2.00b

Microsoft's patch ecosystem was already complex:

  • 2.0a: First silent update
  • 2.0b: Added Token Ring support
  • 2.0c: Ethernet remote boot (CSD8)
  • Patch cycles reached Patch 10 before 2.1 superseded it

The Password Trap: Engineering's Own Goal

The initial release's default admin credentials (ADMIN/password) contained a fatal flaw:

net user ADMIN password /expires:never /domain

But Microsoft hardcoded 90-day expiration without disclosure. By September 10, 1990—just as boxes reached customers—every copy bricked itself. The OS/2 Museum recreation demonstrates the catch-22:

  1. Fresh installations rejected "password"
  2. No domain controller existed to reset credentials
  3. Servers entered zombie state accepting any login but granting zero privileges

Driver Conflicts and Debug Treasures

The Western Digital EtherCard driver (MACWD.OS2) shipped with conflicting defaults:

[protman$]
DRIVERNAME = PROTMAN$

[ms$wd80x3]
DRIVERNAME = MACWD$
ramaddress = 0xD400 ; Conflict with card's D000 default

This caused immediate crashes upon packet reception. Meanwhile, the pirated June 1990 build contained rare artifacts:

  • Debug kernels with Pentium-breaking test register instructions
  • Presentation Manager debug builds
  • Symbol files revealing internal architecture

Source: OS/2 Museum forensic analysis of original 1990 disk images