Microsoft have stated for numerous years that anyone with Kerberos authentication issues often due to users being in multiple groups and commonly known as Token Bloat should increase the MaxTokenSize to 65535 bytes.

Whilst reading Understand and Troubleshoot Dynamic Access Control in Windows Server 2012 guide, I read that

“Previous versions of Windows had a default maximize token size of 12k.  However, this value remained too low for many environments and required reconfiguring each computer in the enterprise.  Windows Server 2012 and Windows 8 increase the default maximum token size to 48k.  This new value is the maximum viable size for SSPI tokens in Windows and may require additional settings changes for applications to support. For example, HTTP settings are required for SSPI tokens over 12K.”

But this article How to use Group Policy to add the MaxTokenSize registry entry to multiple computers also stated the 48K maximum and with a similar reasoning.

“The maximum allowed value of MaxTokenSize is 65535 bytes. However, because of HTTP’s base64 encoding of authentication context tokens, we do not recommend that you set the maxTokenSize registry entry to a value larger than 48000 bytes. Starting with Windows Server 2012, the default value of the MaxTokenSize registry entry is 48000 bytes”.

This lead me to do a little further research as Microsoft stated in the article Active Directory Maximum Limits – Scalability that the “maximum recommended size for a Kerberos ticket is 65,535 bytes”

Getting nowhere fast, I had an email exchange with the Active Directory Documentation team, it was confirmed that this value should now be set to 48K

The Active Directory Maximum Limits – Scalability website should be updated soon (approx. 09/05/2013) to confirm this.

The question now to ask though is – I have set the MaxTokenSIze to 65535 bytes, should I now change it to 48000 bytes?

So I asked the question:-

“What happens to people who have set the key to 65535? Should they test and change it to 48000 now?  Will Windows Server 2012 break? Will things fail as a result of having it set to the maximum?”

The response:-

Kerberos itself doesn’t really understand the concept of a token size because what it transports is opaque to the protocol. 

Applications, however, are different and can implement their own constraints such as buffer size.  Applications ask SSPI (Kerberos) for the size of the authorization buffer of the authenticating user.  If the size reported back is greater than the buffer allocated by the application, authentication fails.  The size reported back is the actual size not the maximum size.  Therefore, with MaxToken set to 65k and authorization data amounting to 12k; Windows will only report back 12k.  MaxTokenSize simply limits the maximum value the SSPI can return to an application.  Prior to Windows 8/2012 , most environments would set MaxTokenSize to the maximum because it was nearly impossible to determine a user’s true token size.  Therefore, if you set it to the max, and still had an authentication problem it was not because of MaxTokenSize ( at which point engineers would instruct customers to return the setting to the prior value).

With MaxTokenSize defaulting to the max Authentication buffer size for IIS; there shouldn’t be a authentication  problem resulting from token size.  Http caps out at 48k.  Making it higher won’t fix the authentication issue. So it there is no gain people nothing by increasing it.

While the setting in the documentation should mostly be harmless; we should suggest 48k as the ideal setting for MaxTokenSize and point to the Group Policy setting in Windows Server 2012/Windows 8 as the means which to modify it.

http://blogs.technet.com/b/askds/archive/2012/09/12/maxtokensize-and-windows-8-and-windows-server-2012.aspx

and now we know.

“The guide contains best-practice recommendations for recovering an Active Directory forest if forest-wide failure renders all domain controllers in the forest incapable of functioning normally. The steps, which you must customize for your particular environment, describe how to recover the entire Active Directory forest to a point in time before the critical malfunction. They also ensure that none of the restored domain controllers replicate from a domain controller with potentially dangerous data.

The steps in this guide apply to Active Directory forests where the domain controllers run Microsoft® Windows Server 2012, Windows Server 2008 R2, Windows Server 2008, and Windows Server 2003 operating systems.”

Please ignore the fact that the document is titled “Windows Server 2008: Planning for Active Directory Forest Recovery” it covers all supported versions of Windows Server that can run Active Directory.

April 2013 Update.

Download it here.

Microsoft have released a new document which contains best practice recommendations to assist organisations in enhancing the security of their Active Directory installations.

Microsoft state that “In implementing these recommendations, organisations will be able to identify and prioritise security activities, protect key segments of their organisation’s computing infrastructure and create controls that significantly decrease the likelihood of successful attacks against critical components of the IT environment“.

This document discusses the most common attacks against Active Directory and countermeasures to reduce the attack surface, and recommendations for recovery in the event of complete compromise.

Download

How you can win

Win your ticket to TechEd Europe 2013 by downloading Microsoft products

If you trial Windows Server 2012 <ISO> <VHD>, Windows Azure and/or System Center 2012 SP1 between 22nd March 2013 and 31st May 2013, you’re in with a chance of winning a ticket to TechEd Europe, hosted this year in the cultural city of Madrid.

To be eligible, download at least one of the three products. Download two or all three to better your chances. You’ll also need to fill out our entry form.

Win a fully funded place at TechEd Europe by writing a short review

We also have three fully funded trips to be won. This takes a bit more effort, but it’s well worth it.

Once you’ve trialled one (or all) of the three products, submit an article/blog post reviewing the experience/product – that will qualify you for a chance to win.

There are three funded places to TechEd Europe to be won, one prize for each of the winning product reviews. There’s also a brand new Windows 8 Phone to be won by three runners up.

You’ll be judged based on your depth of understanding of the product and the breadth of how these can be applied in the modern IT department. The more informative and useful you make the articles for fellow IT pros, the more chance you have of winning.

Each first place prize includes your ticket to TechEd Europe, flights, hotel and meals. Winners will also be part of the TechNet team at the hub of Microsoft’s European community.

To be eligible you must have downloaded at least one of the three products and written a review of your experience; if you download and review all three, you will have tripled your chances of winning.

We’ll also be monitoring Twitter for spot prizes. Just use the hashtag #TechEdChallenge in a tweet for a chance to win some limited edition Microsoft goodies.

We want you to be equipped with all of the knowledge to write a winning article, so to help you learn about the products before you start, we recommend you visit the Microsoft Virtual Academy for product-specific courses that will teach you about the latest features.

To find out more about TechEd Europe 2013, please click here

One prize only per person.

T&Cs apply

I have just returned from the MVP summit in Redmond, where I spent the best part of a week with the Active Directory Product Group and other Directory Services MVP’s.  In conversation with a fellow Directory Services MVP Mike Kline, I mentioned a way that I had spoofed a domain to ensure a DFS namespace continued to seamlessly function after a company we had acquired was integrated into our environment.  Mike thought it would be a good insight for me to share.

Scenario:

We are company XYZ Ltd. and we have an Active Directory forest called xyz.com.

We buy ABC Ltd. who are part of a larger company and they have servers in a domain called continent.abc.com, which is a child domain in a global forest.

Ignoring logistics around user accounts and file permissioning (which was also resolved), when company became our entity, we acquired their file servers (but no Domain Controllers)but we had to enable them to be able to access their existing data in the same DFS namespace as a majority of the files all had embedded links and shortcuts.

Resolution:

The way I achieved this was by using a standalone DFS Server and DNS.

In our domain xyz.com I built a domain joined windows server called the same as the domain name that was used for DFS-N resolution in the acquired company. In this case continent(.xyz.com).

In our domain (xyz.com) I then created a DNS zone called abc.com and then created a CNAME pointing to continent.xyz.com within the abc.com zone, this way I ended up with a server addressable as continent.abc.com. On continent.xyz.com I installed DFS as a standalone implementation and configured all the targets, after which I was left with a server emulating the acquired companies old domain and DFS Namespace.

It goes without saying that this was a temporary solution, as the standalone server was a single point of failure, but it got us over the initial hurdle of seamless data access in a hurry.

I am pleased to say Brian is nearly there with the book and should be available soon.

For further information checkout Brian’s Blog at http://briandesmond.com/blog/active-directory-5th-edition/

The guide is for information technology (IT) professionals and system administrators who need to tune the performance of a server that is running Windows Server 2012.

Included in this white paper:

• Choosing and Tuning Server Hardware
• Performance Tuning for the Networking Subsystem
• Performance Tools for Network Workloads
• Performance Tuning for the Storage Subsystem
• Performance Tuning for Web Servers
• Performance Tuning for File Servers
• Performance Tuning for a File Server Workload (FSCT)
• Performance Counters for SMB 3.0
• Performance Tuning for File Server Workload (SPECsfs2008)
• Performance Tuning for Active Directory Servers
• Performance Tuning for Remote Desktop Session Host (Formerly Terminal Server)
• Performance Tuning for Remote Desktop Virtualization Host
• Performance Tuning for Remote Desktop Gateway
• Performance Tuning Remote Desktop Services Workload for Knowledge Workers
• Performance Tuning for Virtualization Servers
• Performance Tuning for SAP Sales and Distribution
• Performance Tuning for OLTP Workloads

Performance Tuning Guidelines for Windows Server 2012

The paper was last updated on the May 16th 2011 and details:

Choosing and Tuning Server Hardware
Performance Tuning for the Networking Subsystem
Performance Tuning for the Storage Subsystem
Performance Tuning for Web Servers
Performance Tuning for File Servers
Performance Tuning for Active Directory Servers
Performance Tuning for Remote Desktop Session Host (formerly Terminal Server)Performance Tuning for Remote Desktop Gateway
Performance Tuning for Virtualization Servers
Performance Tuning for File Server Workload (NetBench)
Performance Tuning for File Server Workload (SPECsfs2008)
Performance Tuning for Network Workload (NTttcp)
Performance Tuning for Remote Desktop Services Knowledge Worker Workload
Performance Tuning for SAP Sales and Distribution Two-Tier Workload
Performance Tuning for TCP-E Workload

October 2012 Update: 

Updated Server Core Installation Option, Correct Memory Sizing for Child Partitions, and Correct Memory Sizing for Root Partition.

September 2012 Update:

Further updates to the Performance Tuning guidance for the TPC-E Workload section

May 2011 Update:

“Performance Tuning for Web Servers” – Updated guidance to reflect that Http.sys manages connections automatically.

“Performance Tuning for File Servers” – Fixed typos in NFS Server tuning parameter registry keys.

“Performance Tuning for Virtualization Servers” – Added information about Dynamic Memory tuning.

“Performance Tuning for TPC-E Workload” – Clarified tuning guidance.

“Resources” – Updated references.

October 15th Update:

Throughout the paper – Clarified some explanations; clarified energy consumption vs. power consumption.

“Interrupt Affinity” – Added recommendation to use device-specific mechanism for binding interrupts, if supported by the driver model.

“Network-Related Performance Counters” – Added IPv6 and TCPv6.

“Performance Tuning for the Storage Subsystem” – Various minor updates throughout.

“Performance Tuning for File Servers” –Added guidance for NtfsDisableLastAccessUpdate; added “Tuning Parameters for NFS Server”, “File Server Tuning Example”, and “File Client Tuning Example”.

“Performance Tuning for Remote Desktop Session Host” – Added references to two new white papers on capacity planning.

“Monitoring and Data Collection” (multiple sections) – Updated the list of counters to monitor.

“Performance Tuning for File Server Workload (SPECsfs2008)” – New section.

“Performance Tuning for SAP Sales and Distribution Two-Tier Workload” – Substantial updates to the whole section.

“Performance Tuning for TPC-E Workload” – New section.

“Resources” – A few additions and updates.

The sound worked when diagnostics were run, but would not run when Windows 7 was loaded. So I knew it was not defective hardware.

The solution which was relatively easy to implement took a while to discover and I will update this post at a later date with the troubleshooting steps.

The solution was to add to the local administrators group the networkservice and the localservice

This can be done by running these two commands from an elevated command prompt:

net localgroup Administrators /add networkservice

net localgroup Administrators /add localservice

Once these two commands are run, restart the laptop and if your issue was the same as mine, sound (and LAN) should now be working.

I am not sure what the new version of flash has done to my computer but to resolve the issue I had to disable hardware acceleration.

Right Click on the Video, select Settings

and untick the box.

Select Close and refresh the video.

The green bar has now gone and the picture is clearer too.

Hope this helps.