If you see maxtokensize regedit, the following user guide will help you.
Approved: Fortect
- 5 minutes to read.
This document describes how to use Group Policy to add the MaxTokenSize registry entry to multiple laptop computers.
Applies to: Windows Server 2012 R2, Windows Server 2008 R2 SP1
Original Knowledge Base Number: 938118
Presentation
In a controlled domain running Windows Server 2003, Windows Server 2008, Windows Server 2008 R2, or even Windows Server 2012, you can use Group Policy to add the following registry entries to multiple computers:
This article describes how to do this so that you can easily configure this setting for all members of your new domains. The process is different, decide on the version of Windows Server the fact that the domain controller is running.
Additional Information
How To Configure MaxTokenSize Using Group Policy Objects (GPOs) In Windows Server Add 2003
For a registry key for multiple computers in a specific domain that does not have a specific Windows Server 2012 domain controller, do the following actions:
-
Create an Administrative Template (ADM) file for the MaxTokenSize master registry entry. To do this, follow these steps:
-
Launch notepad.
-
Copy and paste the following text into Notepad:
CLASS CAR
CATEGORY !! NOTE
KEY NAME “SYSTEM CurrentControlSet Control Lsa Kerberos Parameters”
POLITICS !! MaxToken
NAME VALUE “MaxTokenSize”
VALUEON NUMERIC 48000
NUMERICAL VALUE OFF 0
END OF POLICYApproved: Fortect
Fortect is the world's most popular and effective PC repair tool. It is trusted by millions of people to keep their systems running fast, smooth, and error-free. With its simple user interface and powerful scanning engine, Fortect quickly finds and fixes a broad range of Windows problems - from system instability and security issues to memory management and performance bottlenecks.
- 1. Download Fortect and install it on your computer
- 2. Launch the program and click "Scan"
- 3. Click "Repair" to fix any issues that are found
END OF CATEGORY
[Strings]
CURB = “Maximum Kerberos Token Size”
MaxToken = “Kerberos MaxTokenSize”Note
The MaxTokenSize registry value is probably set to 48000. Is this the recommended value?
-
Save the Notepad MaxTokenSize document as a special folder% windir% Inf on the domain control that you will use to configure our own GPO to provide the setting.
-
Leave a notepad.
-
-
Import this ADM into a GPO and set MaxTokenSize as the registry entry for the valuable content you want. ForTo do this, follow these steps:
-
Create a final Domain or Corporate Home (OU) restricted Group Policy Object (GPO) that contains your computer accounts. Or select an already deployed GPO.
-
Open each of our Group Policy Editor objects. To do this, click Start, Run, type gpedit.msc and also click OK.
-
In the console tree, expand Computer Configuration, expand Administrative Templates, and then click Administrative Templates.
-
From the Actions menu, select All Tasks and click Add / Remove Templates.
Click Add.
-
Click to select the MaxTokenSize.adm information created in step 1, and then click Open.
-
Click Close.
On the View menu, click Filter.
-
Uncheck the box next to Check only those policy settings that can be fully defined, and then click OK.
-
Expand Administrative Templates and click Maximum Kerberos Token Size.
-
Right-click Kerberos MaxTokenSize in the right Lite, then click Properties to open the Properties dialog box.
-
Click And Checked, then OK.
Note
For a GPO to take effect, the Group Policy sequence must be replicated to all game controllers in the domain, and all affected computers must be restarted after the policy is applied.
-
How To Customize MaxTokenSize Machine Input Using GPOs In Windows Server 2008 And Windows Server 2008 R2
In Windows Server 2008 and Windows Server 2008 R2 domains, you can start by extending the client-side registry to provide our MaxTokenSize registry for evaluating multiple computers in a domain. To create the MaxTokenSize amount setting in a GPO, follow these steps:
- Click Start, Run, type gpmc.msc and, if necessary, click OK to open the Group Policy Management Console.
- In the Group Policy Management Console, create a new GPO to be considered linked at the domain level or included in An organizational unit containing your computer’s accounts. Or you can use the already provided GPO.
- Right-click a GPO, then click Edit to open a specific Group Policy Management Editor window. Computers
- Expand Configuration, expand Settings, and then expand Windows Settings.
- Right-click Registry, select New and select Registry Item. The New Registry Properties dialog box appears.
- Create a list of clicks in action.
- Click HKEY_LOCAL_MACHINE in the list.
- In the key path, click the SYSTEM CurrentControlSet Control Lsa Kerberos Parameters list.
- Enter MaxTokenSize in the Ad Title Value field.
- For Value Type, press REG_DWORD to select a prompt field.
- Enter 48000 in the Value field.
- Go down to base to click the decimal prompt box.
- Click OK.
How To Customize MaxTokenSize Machine Input Using GPO In Windows Server 2012
To provide the value of a registry entryMaxTokenSize in the domain that appears to have Windows 2012 Server Domain Controllers, do one of the following:
- Open Server Manager, click Tools and you need to click Group Policy Management to open the Group Policy Management Console.
- In the Group Policy Management Console, create a new GPO, often associated with the domain level, or sometimes with the organizational unit that contains your computer accounts. Or select an already deployed GPO.
- Right-click a GPO, main window, and then click Edit to open the most common Group Policy Management Editor window.
- Expand Computer Configuration, expand Policies, then expand Administrative, expand Templates.
- Expand and System, then click Kerberos.
- In the right pane, right-click Set Maximum SSPI Kerberos Context Token Buffer Size and select Modify.
- Click On, then enter 48000 in the Maximum Size field.
- Click OK.
Links
For more information about the MaxTokenSize registry entry, typically click the following article number in the Microsoft Knowledge Base:
327825 New version for Kerberos authentication problems when people belong to multiple groups
The maximum allowed MaxTokenSize is 65535 bytes. However, since the HTTP base64 encoding of the Authentication Perspective Tokens is used, we do not recommend setting the maxTokenSize registry entry to a new value greater than 48,000 bytes. Starting in Windows 2012, the default value for the server with the MaxTokenSize registry value is 48,000 bytes.
A similar value for the MaxTokenSize registry entry is almost certainly set to 48000. Is this the recommended value?
For a GPO to take effect, the GPO change must be replicated to all address controllers in the domain, and the affected computers must be restarted after the policy is applied to them.
To receiveAfter GPO ingestion results, the GPO change must be replicated so that all domain controllers in the address and affected computers are restarted after users have applied the policy.
-
For a GPO to result, the GPO change must be replicated to all domain controllers in the domain, and the affected computers must be restarted after the companies have applied the policy.
-
The “Set maximum SSPI Kerberos context token buffer size” policy setting is always added in Windows Server 2012 and appears in Windows 8. The policy setting is supported in Windows XP, Windows Server 03, Windows Vista and Windows Server 09, Windows 7 and Windows Server 2008 R2. To use this Group Policy setting, you need to change the version of Windows Server 2012 or sometimes Windows 8 in gpo where RSAT tools are installed.
Speed up your computer's performance now with this simple download.
