MaxTokenSize and Kerberos Token Bloat
Revision history
# |
Date |
Description |
Author |
Reviewer |
V1 |
2014-3-1 |
MaxTokenSize and Kerberos Token Bloat |
Apollo ye&jacky wu |
|
1 .Description
User can not usecommunicator&G drive& H dirve& connect to outlook
When they login to G dirve needsusername &password
2.Troubleshooting
1. use ping can reach not network problem
2.Go to eventvwr there was amessage
Source: Kerberos
Event ID: 15
Type: Warning
Description:
The Kerberos SSPI package generated an output tokenof size 12589 bytes, which was too large to fit in the token buffer of size12000 bytes, provided by process id 2100.
The application needs to be fixed to supply a tokenbuffer of size at least 65530 bytes.
Other symptoms of being a member of too many groupsare:
1)Internet Explorer reports; The page can notbe displayed error for sites that use Kerberos authentication.
2)Group policy does not apply for the affected users.
In some cases the Kerberos Event ID 15 is recordedin the System Event Log, in other cases other errors or no error is given as towhat the problem may be.
3. Cause
Overviewof MaxTokenSize
The MaxTokenSize by default is12,000 bytes. This has been the default value since Windows 2000 SP2 and stillremains in Windows 7 and Windows 2008 R2. As company’s grow so do the groupswithin your organization. If yourKerberos token becomes too big your users will receive error messages duringlogin and applications that use Kerberos authentication will potentially failas well.
The Kerberos token has a fixed size. If a user is a direct member of a group or amember through group nesting, the security ID (SID) for that group is added tothe user's token. Once a SID is added tothe user’s token it is passed via the Kerberos token during eachauthentication. If the required SIDinformation exceeds the size of the Kerberos token, authentication may fail oraccess to application may fail. Themaximum number of groups a user can be a member of varies, but the limit isapproximately 150-250 groups using the default Kerberos token size in Windows2008.
4. Solution
A registry parameter is available that will allowyou to increase the Kerberos token size. For example, increasing the token sizeto 64 KB (65,535 bytes) allows a user to be a member of more than 900 groups.Because of the associated size of the SID information, this number may vary.
To configure this parameter you should do thefollowing on every Domain Controller and every server / workstation in theDomain.
1)Start Regedit.exe
2)Locate and click the following key in the registry:
HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
3)If the Parameters key is notpresent, create the key. To do so:
a.Click the following key in the registry:
b.HKLM\System\CurrentControlSet\Control\Lsa\Kerberos
i.On the Edit menu, click Add Key.
ii.Create a Parameterskey.
iii.Click the new Parameterskey.
4)On the Edit menu, click Add Value, and then add the following registryvalue:
a.Value name: MaxTokenSize
b.Data type: REG_DWORD
c.Radix: Decimal
d.Value data: 65,535
e.Microsoft still recommends setting this value to 65,535 decimal (0xFFFFhexadecimal). If you set this value togreater than 65,535 decimal Kerberos authentication of some operations mayfail, and some programs may return errors.
5)Quit Regedit.exe
How to use Group Policy to add the MaxTokenSize registry entry to multiplecomputers
http://support.microsoft.com/kb/938118/EN-US
How to configure the MaxTokenSize registry entry byusing GPO in Windows Server 2008 and in Windows Server 2008 R2
In Windows Server 2008 domains and in Windows Server 2008 R2 domains,you can use the Registry Client-Side Extension to deploy the MaxTokenSizeregistry value to multiple computers in a domain. To create the MaxTokenSizevalue setting in a GPO, follow these steps:
1.Click Start, click Run, type gpmc.msc,and then click OK to open the Group Policy Management Console.
2.In the Group Policy Management Console, create anew GPO that is linked at the domain level or that is linked to the OU thatcontains your computer accounts. Or you can select a GPO that is alreadydeployed.
3.Right-click the GPO, and then click Edit toopen the Group Policy Management Editor window.
4.Expand Computer Configuration, expand Preferences,and then expand Windows Settings.
5.Right-click Registry, point to New,and then click Registry Item. The New Registry Properties dialogbox appears.
6.In the Action list, click Create.
7.In the Hive list, click HKEY_LOCAL_MACHINE.
8.In the Key Path list, click SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters.
9.In the Value name box, type MaxTokenSize.
10.In the Value type box, click to select the REG_DWORDcheck box.
11.In the Value data box, type 48000.
12.Next to Base, click to select the Decimalcheck box.
13.Click OK.
New resolution for problems with Kerberos authentication when users belongto many groups
http://support.microsoft.com/kb/327825
"HTTP 400 - BadRequest (Request Header too long)" error in Internet Information Services(IIS)
http://support.microsoft.com/default.aspx?scid=kb;EN-US;2020943
Users who are members of more than 1,015 groups may fail logonauthentication
http://support.microsoft.com/kb/328889/
Group Policy may not be applied to users belonging to many groups
http://support.microsoft.com/kb/263693/
http://blogs.technet.com/b/shanecothran/archive/2010/07/16/maxtokensize-and-kerberos-token-bloat.aspx