Active Directory Cookbook

14.18. Forcing Kerberos to Use TCP

Problem

Clients are experiencing authentication problems and you’ve determined it is due to UDP fragmentation of Kerberos traffic. You want to force Kerberos traffic to go over TCP instead.

Solution

Using a graphical user interface

1. Run regedit.exe from the command line or Start → Run.

2. In the left pane, expand HKEY_LOCAL_MACHINE → System → CurrentControlSet → Control → Lsa → Kerberos → Parameters.

3. Right-click on Parameters and select New → DWORD value. Enter MaxPacketSize for the value name.

4. In the right pane, double-click on MaxPacketSize and enter 1.

5. Click OK.

Using a command-line interface

> reg add "HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters" /v[RETURN] 
"MaxPacketSize" /t REG_DWORD /d 1

Using VBScript

' This code forces Kerberos to use TCP 
' ------ SCRIPT CONFIGURATION ------
strComputer = "<ComputerName>"  ' e.g. rallen-w2k3
' ------ END CONFIGURATION ---------

const HKLM = &H80000002
strRegKey = "SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters"
set objReg = GetObject("winmgmts:\\" & strComputer & _
                       "\root\default:StdRegProv")
objReg.SetDwordValue HKLM, strRegKey, "MaxPacketSize", 1
WScript.Echo "Kerberos forced to use TCP for " & strComputer

Discussion

If you have users that are experiencing extremely slow logon times (especially over VPN) or they are seeing the infamous “There are currently no logon servers available to service the logon request,” then they may be experiencing UDP fragmentation of Kerberos traffic. One way ...