This is in regard to the authui.dll that hilton shared with us, but didn't tell us where he got it from... I have been trying to figure out what the difference is that allows the mod to work. Firstly though, the authui.dll file from Server 2008 is per-byte identical to the authui.dll from Vista SP1. Here is what I found on the modified authui.dll file...

EDIT: Found branding. "This Logon was created by iSoftech a.k.a Yusuff for Leopard Skin. (c) 2007 iSoftech ."

- It is from Vista without SP1 [version is 6.0.6000.x instead of 6.0.6001.x] which could cause issues for Server 2008 [because they are all Vista SP1 equivalent system files]
- Resources 11200, 11300 and 11400 under BITMAP are added - it appears to be an alternative [better IMO] icon for the Accessibility Settings that usually appears bottom-left corner of the logon screen. [see attatchment 01]
- Resources 1700x under IMAGE, which is the 'glowing vista orb' animation that appears before the logon screen, is modded to an Apple/Macintosh icon. So this DLL was probably taken from some kind of "OSX Makeover for Vista". Couldn't be bothered investigating, no point. [See attatchment 02]
- MUI resource is different in both filesize and content - unknown whether it is a SP1 change or a mod. As it is binary data, I still need to investigate what exactly the difference is.
- Both of the UIFILE resources are different. I have a good feeling that something in here is what we need to change to get logon screens in 2008... or at least I hope, as they are just massive text files as opposed to unreadable binary data =)
- Version data resource is different, as stated in my first point
- In the WEVT_TEMPLATE resource, around the header, the modified file has for some reason 4 bytes modifed to FF FF FF FF instead of the 01 00 00 90 from Vista SP1. Absolutely no idea why this is the case, although usually hackers/crackers use FF-byte sequences to brand files to show people like me/us that "yes this file has been modified and is not the original", usually in a padded data area [which is never read by the system] for obvious reasons.

Anyway i'm looking into this right now, hopefully I can make a one-click-patch-EXE that will turn your authui.dll from Server 2008 into a modified one that will be version/future proof [with a seek and replace method of patching]. I'll let you guys know. Peace.

SOLUTION

Use the authui.dll from Vista SP0; that is, a non-SP1 version. It is identified with version 6.0.6000.x as opposed to 6.0.6001.x but I have found different revisions of it [what the x stands for in version number]. I downloaded one from a logon screen mod which included the 'original' Vista one, labelled as 6.0.6000.16386 which is the same version as the Leopard modded one hilton posted. However, the one from my Vista DVD is labelled as 6.0.6000.16513 which is higher/newer, but still not SP1. Must of been updated in a hotfix somewhere.

I wish we didn't have to resort to using an older version of the file, but I don't think we have a choice and this is why I think so. Windows Server 2008 RTM is infact SP1, there is no such thing as Server 2008 RTM without SP1. Also, the authui.dll file from Vista SP1 is identical to the Server 2008 one. So why i think this works is because the SP1/Build 6001 version of the file has extra code that allows it to be aware of it being executed on a Server OS, but Vanilla/SP0/Build 6000 version was created before Server 2008 was even released or near completion, and as such is not aware or does not have the code to make it all like "oh lets check if it's server or vista and show the right graphic for it" because it just assumes it's Vista, as there only was Vista out at the time.

Make sense?

So easy solution - replace your authui.dll file with the Vista 6000/SP0 version of authui.dll and backdrop image will work 100%, I have provided my version of it attatched from my DVD [v6.0.6000.16513] incase you don't have a Vista DVD. This file version might be newer than the one you already have too. Of course, there is always a risk of system malfunction because we are reverting to, technically, a non-server DLL file. But I think the authui.dll file is not critical to server/OS functions perse - it's not like we are replacing a system driver or explorer.exe but with that said, I have already made the change to my system, and we should keep this thread open so all of us can report possible problems that may be related to this. Specifically, remote login and other network authentication issues, and other things to do with logon/authentication. I don't see it as likely, but who knows hey...

...pretty sure authui is just a visual/graphic/resource library for the logon screen anyway and probably isn't even read/loaded unless locking/login/logoff is performed or requested.... anyway enough of my ramblings!

Maybe sawo could put this in the workstation converter too. Anywho, here's my file - unmodified original from my Vista DVD - that returns the graphic BG of the logon screen. Programs like logon studio and such should work now - will test shortly to confirm. Enjoy and peace!


EDIT: THIS IS FOR 32-BIT ONLY. See later in the thread for the 64-bit method!

It doesn't work on x86-x64 S2k8 *gaah*

It works 100% for me, x86. I tested it in a brand-new fresh install of Server 2008 Standard 32-bit in VMWare, and now have it working on my real install =)

No idea how to get it working on x64, but i'm sure someone here who actually knows x64 can replicate what i've done?

If you are running x86, grab this zip file, extract to a new folder [anywhere] and run Do.bat - it will take ownership of authui.dll and replace the file with the new one after a reboot. The original will be saved to authui.dll.bak [in the same system32 folder].

FYI, it uses simple batch with the help of an AutoIt script to replace the system file at reboot; it's an uncompiled au3 file [with the AutoIt3.exe interpreter included so you don't have to have AutoIt installed] so you can use the code for your own tools if you wish =)

Hope this gets it working for you, otherwise i'm seriously halucinating.



Oh and P.S. - LogonStudio Vista does work for me, but I cannot restore the original logon after changing it. Uninstalling LogonStudio still didn't fix it! Stupidly I didn't backup my imageres.dll file but luckily I have a VMWare HDD image that I can just mount and grab the original one =D I don't know why it can't "restore" the original and I really couldn't be bothered, but just be aware of this!

I have done some research on this issue in the past as I would love to use LogonStudioVista with x64 WS2008 but have failed so far.

I think what you may be running up a gainst is WIndows Resource Protection (http://msdn.microsoft.com/en-us/library/aa382503.aspx), which in short prevents any changes to a protected list of installed programs, which this dll is one of. I have experienced replacing the file (even under safe boot), and finding the system quickly replaces it back! You need to use a particular set of APIs, that for example Windows Installer uses, to make a file change stick.

I concluded to myself this was the issue, there in fact may be even more robust protection under Windows Server 2008 x64 but I can't remember now as its been 6 months since I researched this.

Good luck if this helps you make some progress!

Yeah Windows XP has a similar thing called System File Protection (SFP) where if it detects a changed dll it grabs the original out of the hidden dllcache\ folder and replaces it pretty much straight away... for some reason they removed it in Vista/2008 x86, maybe UAC was the replacement, but it looks like x64 has it instead now... strange.

I really should get my hands on an x64 copy, now that I can run it, to try and figure this 64-bit trouble everyone has...

EDIT: This guy has written a detailed post on how to resource hack DLL's in Vista x64, namely how to bypass Windows File Protection [WFP] which apparently is in x86 (but I didn't have to turn it off to replace it!?!)

http://www.joejoe.org/forum/index.php?showtopic=3141

Hopefully that helps.

EDIT2: Basically that guy is just replacing DLL's from his x64 Vista while in a x86 Vista [dual boot], doing it to both the system32\ DLL and the SysWOW64\ dll. This is how I remember it exactly aswell, so I don't see what the problem is. If you can't install a second x86 Vista/XP to replace the DLL's in, check out BartPE at http://www.nu2.nu/pebuilder/

Someone must have a way to replace x64 DLL's more easily. Sadly I can't find one.

Hmm If i choose a x86 DLL i think i get the same effect on bootup: Black Screen and only visible mousecursor - nothing more yet.

But i can test it again with one of the x86 files from here

Try and get authui.dll from x64 version of Vista, both the System32\ one and SysWOW64\ ones. Replace the Server 2008 ones with those - backup your originals beforehand of course as you know [saying that incase a newbie reads this post].

But it's important to use the authui.dll(s) from a non SP1 release of Vista, that is what allows it to work!

But we still don't get the startup Orb. As Arris said though, i think the only way to do it is to somehow make Server 2008 "think" it's Vista. That would be amazing, especially for compatibility. I've actually found leads on this, that DOESN'T require the vista tokens.dat [which is 100% illegal], it's related to the logon module [unsure if it's winlogon.exe yet]. If it works, every program that checks OS version will see your PC as a workstation edition rather than server.

EDIT: Changing Server 2008 to an NT Workstation version has already been done. But it's considered warez, and is dangerous. It's done with the same method I was thinking of, and is indeed a mod of winlogon.exe... i'm not going to use it because of all the warnings [completely breaking your system, not just installs but SID's aswell, making all data unreadable]. Bummer. Nevermind.

uff thats a problem, I get one x86-x64 authui.dll SP0 from this topic. and this file runs now in my wow64 folder successfully - can anyone send me a x86-64 authui.dll SP0 for the system32 folder ?

Thats very confusing, because in the text there is no description for which folder the x64-86 file is =)

@Backup:

yeaha I always rename the original files to authui.ori and if the "modded" file messed up the system I use the recovery console " cmd " in the non gui part of Longhorn hihi

I would, but I don't have the 64-bit copy of Vista =( thinking of dow.... buying it just so I can do this kind of stuff, and actually help your x64 guys out better... sorry... hopefully someone notices though! I'll help you out though...

Could somebody share a \system32\authui.dll file from 64-bit Vista WITHOUT SP1? NOT the SysWOW64 one?


My bad.... I only talk about x86 most of the time as I thought most people are on 32-bit OS - but it seems most of the active users here are on x64??? Hmm...


I change mine to .BAK =) and I have tri-boot between 2K8, XP and OSX, so don't need a recovery console anymore.. but always used to have it installed before Vista came... how do you get Longhorn recovery console installed??? Or do you mean boot from the DVD? Because I noticed they took that out... you could install it as a boot option for XP, now it's gone =(