Microsoft have stated for numerous years that anyone with Kerberos authentication issues often due to users being in multiple groups and commonly known as Token Bloat should increase the MaxTokenSize to 65535 bytes.

Whilst reading Understand and Troubleshoot Dynamic Access Control in Windows Server 2012 guide, I read that

“Previous versions of Windows had a default maximize token size of 12k.  However, this value remained too low for many environments and required reconfiguring each computer in the enterprise.  Windows Server 2012 and Windows 8 increase the default maximum token size to 48k.  This new value is the maximum viable size for SSPI tokens in Windows and may require additional settings changes for applications to support. For example, HTTP settings are required for SSPI tokens over 12K.”

But this article How to use Group Policy to add the MaxTokenSize registry entry to multiple computers also stated the 48K maximum and with a similar reasoning.

“The maximum allowed value of MaxTokenSize is 65535 bytes. However, because of HTTP’s base64 encoding of authentication context tokens, we do not recommend that you set the maxTokenSize registry entry to a value larger than 48000 bytes. Starting with Windows Server 2012, the default value of the MaxTokenSize registry entry is 48000 bytes”.

This lead me to do a little further research as Microsoft stated in the article Active Directory Maximum Limits – Scalability that the “maximum recommended size for a Kerberos ticket is 65,535 bytes”

Getting nowhere fast, I had an email exchange with the Active Directory Documentation team, it was confirmed that this value should now be set to 48K

The Active Directory Maximum Limits – Scalability website should be updated soon (approx. 09/05/2013) to confirm this.

The question now to ask though is – I have set the MaxTokenSIze to 65535 bytes, should I now change it to 48000 bytes?

So I asked the question:-

“What happens to people who have set the key to 65535? Should they test and change it to 48000 now?  Will Windows Server 2012 break? Will things fail as a result of having it set to the maximum?”

The response:-

Kerberos itself doesn’t really understand the concept of a token size because what it transports is opaque to the protocol. 

Applications, however, are different and can implement their own constraints such as buffer size.  Applications ask SSPI (Kerberos) for the size of the authorization buffer of the authenticating user.  If the size reported back is greater than the buffer allocated by the application, authentication fails.  The size reported back is the actual size not the maximum size.  Therefore, with MaxToken set to 65k and authorization data amounting to 12k; Windows will only report back 12k.  MaxTokenSize simply limits the maximum value the SSPI can return to an application.  Prior to Windows 8/2012 , most environments would set MaxTokenSize to the maximum because it was nearly impossible to determine a user’s true token size.  Therefore, if you set it to the max, and still had an authentication problem it was not because of MaxTokenSize ( at which point engineers would instruct customers to return the setting to the prior value).

With MaxTokenSize defaulting to the max Authentication buffer size for IIS; there shouldn’t be a authentication  problem resulting from token size.  Http caps out at 48k.  Making it higher won’t fix the authentication issue. So it there is no gain people nothing by increasing it.

While the setting in the documentation should mostly be harmless; we should suggest 48k as the ideal setting for MaxTokenSize and point to the Group Policy setting in Windows Server 2012/Windows 8 as the means which to modify it.

http://blogs.technet.com/b/askds/archive/2012/09/12/maxtokensize-and-windows-8-and-windows-server-2012.aspx

and now we know.

The sound worked when diagnostics were run, but would not run when Windows 7 was loaded. So I knew it was not defective hardware.

The solution which was relatively easy to implement took a while to discover and I will update this post at a later date with the troubleshooting steps.

The solution was to add to the local administrators group the networkservice and the localservice

This can be done by running these two commands from an elevated command prompt:

net localgroup Administrators /add networkservice

net localgroup Administrators /add localservice

Once these two commands are run, restart the laptop and if your issue was the same as mine, sound (and LAN) should now be working.

If you are looking to understand what the security policies in Windows 7 and 2008 R2 mean and how they can impact your environment, then this guide is a must read.

Threats and Countermeasures Guide: Security Settings in Windows 7 and Windows Server 2008 R2

The document is covers the following categories in some depth:

Account Policies

This section discusses the Group Policy settings that are applied at the domain level: password policies, account lockout policies, and Kerberos protocol authentication policies.

Advanced Security Audit Policy

This section discusses the use of advanced audit policy settings, which are now integrated with Group Policy to monitor and enforce your security measures. It describes the various settings, and it provides examples of how audit information is modified when the settings are changed.

User Rights

This section discusses the various logon rights and privileges that are provided by the Windows 7 and Windows Server 2008 R2 operating systems, and it provides guidance about which accounts should be assigned these rights.

Security Options

This section provides guidance about security settings for digital data signatures, Administrator and Guest account names, drive access, driver installation behaviour, and logon prompts.

Event Log

This section provides guidance about how to configure the settings that relate to the various event logs on computers running Windows Server 2008 R2 or Windows 7.

System Services

Windows Server 2008 R2 and Windows 7 include a variety of system services. Many of these services are configured to run by default, but others are not present unless you install specific components. This section describes the various services included with the operating systems so that you can best decide which ones to leave enabled and which ones can be safely disabled.

Software Restriction Policies

This section provides a brief overview of the Software Restriction Policy feature that is available in Windows Server 2008 R2 and Windows 7. It provides links to additional resources about how to design and use policy settings to control which applications can be used in your organization.

Application Control Policies

This section provides a brief overview of the AppLocker™ feature that is available in Windows Server 2008 R2 and Windows 7. It provides links to additional resources about how to design and use policy settings to control which applications can be used in your organization.

External Storage Devices

This section describes Group Policy settings that can be used to limit, prevent, or allow the use of external storage devices in networked computers.

Additional Resources

This section provides links to additional information sources about Windows security topics from Microsoft that you may find useful.

Threats and Countermeasures Guide: Security Settings in Windows 7 and Windows Server 2008 R2

May 2 – Toronto | May 4 – Detroit | May 6 – Chicago | May 9 – Indianapolis | May 11 – Dallas | May 13 – Columbus

The Springboard Series Tour is back! This 6 city tour brings the top product teams from Microsoft to you. We understand the questions and issues that IT pros deal with every day. How do I manage end users bringing consumer devices into the office? Should we look to the cloud for key solutions? Should I virtualize? What are the best tools to manage application compatibility and deployment? The Springboard Series Tour brings the experts and the answers.

Join us for a full day’s deep dive into the tools, solutions and options to help you do more with less. We will cover managing the flexible workspace, a first look at Windows Intune and Office 365. We’ll also show you some of the new Windows Slates and give you details around Microsoft’s strategy for Slate devices. We will preview  the new tools in the MDOP 2011 suite, a deep dive into managing and deploying Office 2010 and great tips and tricks to help you deploy Windows 7 and move your users from Windows XP with speed and ease.

REGISTER NOW and save your seat for this free day of technical demos, Q&A sessions, and real-world guidance from Microsoft experts.

Remote Server Administration Tools for Windows® 7 with SP1 enables IT administrators to manage roles and features that are installed on computers that are running Windows Server® 2008 R2, Windows Server® 2008, or Windows Server® 2003, from a remote computer that is running Windows 7 or Windows 7 with SP1.

http://www.microsoft.com/downloads/en/details.aspx?FamilyID=7d2f6ad7-656b-4313-a005-4e344e43997d

Note that it is important to remove all versions of Administration Tools Pack or Remote Server Administration Tools from the computer before installing Remote Server Administration Tools for Windows 7 with SP1.

So following the instructions, I disabled my anti-virus and repeated the process, but once again I received ERROR_ACCESS_DENIED(0×80070005).

Having worked with Windows for many years, I knew to go on the hunt for the installation logs.

Navigating to C:\Windows\Logs\CBS, I located the log called CBS.log

Opening the log file I searched for the usual negative terms such as failure, denied and error, with Error giving me the most results.

I found multiple references in the CBS.log such as these.

2011-02-20 17:02:03, Info CBS    Failed to get session package state for package: Package_2_for_KB978601~31bf3856ad364e35~amd64~~6.1.1.1 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2011-02-20 17:02:03, Info CBS    Failed to get session package state for package: Package_37_for_KB2443685~31bf3856ad364e35~amd64~~6.1.1.0 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]
2011-02-20 17:02:05, Info CBS    Failed to get session package state for package: Package_2_for_KB974431~31bf3856ad364e35~amd64~~6.1.1.5 [HRESULT = 0x80070490 - ERROR_NOT_FOUND]

I am not sure as to why these updates were reporting an ERROR_NOT_FOUND message, but after fully examining the CBS.log file I was left with a list of these updates (Note: this is my list of updates to remove, yours could be different).

KB2207566
KB2296011
KB2305420
KB2385678
KB2393802
KB2443685
KB2454826
KB2467023
KB2479628
KB2482017
KB2485376
KB2487426
KB972270
KB974431
KB974571
KB975467
KB977617
KB978601
KB978637
KB979482
KB979688
KB980846
KB982110
KB982799

Opening from the Control Panel, Programs and Features and then by selecting “view installed updates”, I removed all the listed updates that reported ERROR_NOT_FOUND in the CBS.log.

I then rebooted and attempted to reinstall Windows 7 Service Pack 1 again and hey presto, after about an hour, my laptop was up and running with Windows 7 Service Pack 1.

When I get time, I will investigate why I got these errors in the first place, but for me the important thing was getting Service Pack 1 on the laptop.  I am coming to the conclusion this issue was caused by having a pre-release of the service pack on my laptop as my other machines, which did not have a pre-release version of Service Pack 1 installed have been error free.

I HOPE THIS HELPS, THIS SOLUTION WORKED FOR ME, BUT DOES NOT MEAN IT WILL WORK FOR YOU.

Information that is relevant to Service Pack 1 is documented below. 

Documentation.

Deployment Guide for Windows Server 2008 R2 with SP1 and Windows 7 with SP1

Hotfixes and Security Updates included in Windows 7 and Windows Server 2008 R2 Service Pack 1 
(757 Hotfixes and 39 Security updates).

Installing Windows Server 2008 R2 with SP1

Release Notes for Windows 7 with Service Pack 1

Release Notes for Windows Server 2008 R2 with Service Pack 1

Windows 7 and Windows Server 2008 R2 Service Pack 1 Notable Changes

Software

Windows Server 2008 R2 and Windows 7 SP1

The Windows Automated Installation Kit (AIK) for Windows 7 SP1 (This is an incremental update to the WAIK).

Early KB Articles

Some programs have compatibility issues with Service Pack 1 for Windows 7 and for Windows Server 2008 R2

“Display driver stopped responding but has recovered” error in a Windows 7 SP1-based VM that has a RemoteFX video adapter

TBC….

Windows Virtual PC is the latest Microsoft virtualization technology. You can use it to run more than one operating system at the same time on one computer, and to run many productivity applications on a virtual Windows environment, with a single click, directly from a computer running Windows 7.

Download it Here

Supported host operating systems

• Windows 7 Home Basic
• Windows 7 Home Premium
• Windows 7 Enterprise
• Windows 7 Professional
• Windows 7 Ultimate

Supported guest operating systems

• Windows XP Service Pack 3 (SP3) Professional
• Windows Vista Enterprise Service Pack 1 (SP1) and later versions
• Windows Vista Ultimate Service Pack 1 (SP1) and later versions
• Windows Vista Business Service Pack 1 (SP1) and later versions *
• Windows 7 Professional *
• Windows 7 Enterprise.
• Windows 7 Ultimate

*Note Virtual applications are not supported on Windows Vista Business or on Windows 7 Professional. All other features of Windows Virtual PC are supported on these two guest systems.