环境:

AD:Windows Server 2003升级Windows Server 2008 R2

客户端:Windows 7+XP mode

故障:

AD 2003升级到2008 R2(系统升级,其他没变),导致客户端Windows 7内的XP mode登陆域时间过长,在XP Mode重新配置用户配置文件,登陆正常。

在AD上看到日志有Event 40960和40961的警告:

Event ID: 40960 

Source: LsaSrv  

Type: Warning 

Category: SPNEGO (Negotiator)  

Description: The Security System detected an attempted downgrade attack for server . The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)".

Event ID: 40691 

Type: Warning 

Source: LSASRV 

Category: SPNEGO (Negotiator) 

Description: 

The Security System could not establish a secured connection with the server ldap/xxxx.com. No authentication protocol was available.

解决方法:

在XP mode用本地管理员登陆,打开注册表,在[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters] 

添加DWORD,DWORD名字为MaxPacketSize,值为1