KRB_ERR_RESPONSE_TOO_BIG – Forcing TCP/IP over UDP

I thought I had this error on my blog somewhere, but when I went looking for it, I could not find it…
 
When you are working in an environment that uses machines running earlier versions of Windows than 2008 Server or Windows Vista, you may encounter an authentication problem when trying to pass through authentication using Kerberos tickets.
 
Essentially, the UDP Protocol cannot handle the larger size packets required to capture a Kerberos ticket for someone who has a large collection of groups associated with their login. This scenario has a list of dependencies required to trigger it which are outlined in KB Article 244474, but the fix is to set the following registry key on the web server to 1:
 
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
MaxPacketSize=1 (Decimal)
 
The Parameters key may not exist, if it does not, then create it.  The KB Article http://support.microsoft.com/kb/326985 has a lot of useful links to Kerberos articles and descriptions which I have used in the past, so you may also find that helpful.
 
B
Advertisements

About Brad Saide

I'm a SharePoint consultant. I'm also slowly going bald, seem to have a permanent spare tyre around my waist and enjoy socialising with friends over a beer or 10. The last 2 may possibly be related. Started working with SharePoint when the first version was in limited beta release (participated in the Technology Adoption Program while at Woolworths) and have been committed to the adoption of the technology as a business enabler ever since.
This entry was posted in Uncategorized. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s