Unearthing LAN Manager 2.0: Microsoft's Forgotten Networking Time Bomb
Share this article
The Cryptographic Time Bomb in Microsoft's Networking Past
When Microsoft shipped LAN Manager 2.0 in 1990, they accidentally planted a password expiration time bomb that would render fresh installations completely unusable after September 10, 1990—just as customers finally received the software. This revelation comes from forensic examination of recently rediscovered original disk images analyzed by the OS/2 Museum, exposing one of Microsoft's most spectacular enterprise misfires.
The Phantom Release
Microsoft's LAN Manager 2.0 existed in limbo between June and August 1990. Forensic evidence shows:
- Final builds compiled June 28, 1990
- Dependency on OS/2 1.21 (unavailable until August)
- Shrink-wrap release strategy that alienated OEM partner 3Com
- Press release ambiguity about August "release" timing
"Files dated after June 1990 are typically version 2.0"
– Microsoft's own MS-DOS 5.0 readme
Versioning Chaos: CSD Archaeology
Without built-in version commands (NET VER arrived in 2.1), administrators relied on cryptic LANMAN.CSD files:
; June 1990 build
CSD = 0
BUILDDATE = 06-28-1990
; November 1990 build
CSD = 2
BUILD = 2.00b
Microsoft's patch ecosystem was already complex:
- 2.0a: First silent update
- 2.0b: Added Token Ring support
- 2.0c: Ethernet remote boot (CSD8)
- Patch cycles reached Patch 10 before 2.1 superseded it
The Password Trap: Engineering's Own Goal
The initial release's default admin credentials (ADMIN/password) contained a fatal flaw:
net user ADMIN password /expires:never /domain
But Microsoft hardcoded 90-day expiration without disclosure. By September 10, 1990—just as boxes reached customers—every copy bricked itself. The OS/2 Museum recreation demonstrates the catch-22:
- Fresh installations rejected "password"
- No domain controller existed to reset credentials
- Servers entered zombie state accepting any login but granting zero privileges
Driver Conflicts and Debug Treasures
The Western Digital EtherCard driver (MACWD.OS2) shipped with conflicting defaults:
[protman$]
DRIVERNAME = PROTMAN$
[ms$wd80x3]
DRIVERNAME = MACWD$
ramaddress = 0xD400 ; Conflict with card's D000 default
This caused immediate crashes upon packet reception. Meanwhile, the pirated June 1990 build contained rare artifacts:
- Debug kernels with Pentium-breaking test register instructions
- Presentation Manager debug builds
- Symbol files revealing internal architecture
Source: OS/2 Museum forensic analysis of original 1990 disk images