Oracle case insensitive passwords seemingly ignoring SEC_CASE_SENSITIVE_LOGON
Create a password file, set it to insensitive. You should have a password file, even on windows, even if all it does is define who can connect as a sysdba. I just installed a default Standard Edition and a password file was created. THe last time I built a new EE system it was the same way.

Here's the doc for how to set one up if you don't know. Make sure you use the case sensitive switch and turn it off:
http://docs.oracle.com/cd/B28359_01/server.111/b28310/dba007.htm#ADMIN10241