Forum Search:
Forum.Brain-Cluster.com: Brain Cluster Technical Forum
Ultimate forum for Technical Discussions

Home » Microsoft » Windows Server » Active Directory » MaxtokenSize Reached
MaxtokenSize Reached [message #160746] Mon, 07 September 2009 08:33 Go to next message
jos  is currently offline jos
Messages: 20
Registered: August 2009
Junior Member
Hello all,

We have issues with Outlook not able to open for some users that are member
of to large groups (~390).

The exact symptoms are :

1. "outlook can not connect to exchange servers" appearing in the right pane
of outlook.

2. In the system eventlog of the user computer, there are several Warning
eventID 6 related to kerberos pb . See:
http://support.microsoft.com/kb/935744 for details.

3. tokensz command launched against the user shows:
Name: Negotiate Comment: Microsoft Package Negotiator
Current PackageInfo->MaxToken: 12128
Status = 2148074240 0x80090300 SEC_E_INSUFFICIENT_MEMORY

4. those users have no pb accessing resources share on file servers.

The immediate solution was to raise the maxtokensize to 65535.

Results:
The tokensz shows now the following results:
Name: Negotiate Comment: Microsoft Package Negotiator
Current PackageInfo->MaxToken: 65663
MaxTokenSize (incomplete context): 12372

The user can now open his outlook with success.

Question:
I have a doubt where to apply the reg: is it on the exchange serverside or
on the user's box side ? I apply the reg on the user's computer because i
presumed that the pb WAS on the user's box due to the evenit 6 appearing. Am
i right or wrong ?

Thanx for clarification :)

Jose.
Re: MaxtokenSize Reached [message #160753 is a reply to message #160746] Mon, 07 September 2009 12:00 Go to previous messageGo to next message
rishicool2002  is currently offline rishicool2002  United States
Messages: 4
Registered: July 2009
Junior Member
Jose,
You did the right thing by applying the registry only the client
computer. This registry key is created on the machine, where the
Kerberos events are logged.
KB:935744, has complete explanation on this.

Regards,
Rishi
Microsoft Server Support (Directory Services)


--
rishicool2002
------------------------------------------------------------ ------------
rishicool2002's Profile: http://forums.techarena.in/members/114615.htm
View this thread: http://forums.techarena.in/active-directory/1243111.htm

http://forums.techarena.in
Re: MaxtokenSize Reached [message #160777 is a reply to message #160753] Tue, 08 September 2009 06:21 Go to previous messageGo to next message
jos  is currently offline jos
Messages: 20
Registered: August 2009
Junior Member
Hello Rishi :)

Last question:

What is your opinion on this:
1. We install the registry on all computers & servers.
2. We install the registry ONLY on computers that have the eventID 6.

Thank you.

"rishicool2002" wrote:

>
> Jose,
> You did the right thing by applying the registry only the client
> computer. This registry key is created on the machine, where the
> Kerberos events are logged.
> KB:935744, has complete explanation on this.
>
> Regards,
> Rishi
> Microsoft Server Support (Directory Services)
>
>
> --
> rishicool2002
> ------------------------------------------------------------ ------------
> rishicool2002's Profile: http://forums.techarena.in/members/114615.htm
> View this thread: http://forums.techarena.in/active-directory/1243111.htm
>
> http://forums.techarena.in
>
>
Re: MaxtokenSize Reached [message #160783 is a reply to message #160777] Tue, 08 September 2009 06:49 Go to previous messageGo to next message
pbbergs  is currently offline pbbergs  United States
Messages: 1024
Registered: July 2009
Senior Member
Yes you can increase the token size but I would look at why you have such a
token bloat issue. As the token increases logon times are going to
increase, etc... I would work to reduce the size, Microsoft made it the
size that it is for a reason. You are using to many groups, I don't see why
anyone should belong to 390 groups, that is the real problem here.

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"josé" <jos@discussions.microsoft.com> wrote in message
news:286ED661-2DA1-4D1C-B775-BB995B079CDA@microsoft.com...
> Hello Rishi :)
>
> Last question:
>
> What is your opinion on this:
> 1. We install the registry on all computers & servers.
> 2. We install the registry ONLY on computers that have the eventID 6.
>
> Thank you.
>
> "rishicool2002" wrote:
>
>>
>> Jose,
>> You did the right thing by applying the registry only the client
>> computer. This registry key is created on the machine, where the
>> Kerberos events are logged.
>> KB:935744, has complete explanation on this.
>>
>> Regards,
>> Rishi
>> Microsoft Server Support (Directory Services)
>>
>>
>> --
>> rishicool2002
>> ------------------------------------------------------------ ------------
>> rishicool2002's Profile: http://forums.techarena.in/members/114615.htm
>> View this thread: http://forums.techarena.in/active-directory/1243111.htm
>>
>> http://forums.techarena.in
>>
>>
Re: MaxtokenSize Reached [message #160785 is a reply to message #160783] Tue, 08 September 2009 06:55 Go to previous messageGo to next message
jos  is currently offline jos
Messages: 20
Registered: August 2009
Junior Member
Thank u :)

"Paul Bergson [MVP-DS]" wrote:

> Yes you can increase the token size but I would look at why you have such a
> token bloat issue. As the token increases logon times are going to
> increase, etc... I would work to reduce the size, Microsoft made it the
> size that it is for a reason. You are using to many groups, I don't see why
> anyone should belong to 390 groups, that is the real problem here.
>
> --
> Paul Bergson
> MVP - Directory Services
> MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> 2008, 2003, 2000 (Early Achiever), NT4
> Microsoft's Thrive IT Pro of the Month - June 2009
>
> http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewsGroup This
> posting is provided "AS IS" with no warranties, and confers no rights.
>
> "josé" <jos@discussions.microsoft.com> wrote in message
> news:286ED661-2DA1-4D1C-B775-BB995B079CDA@microsoft.com...
> > Hello Rishi :)
> >
> > Last question:
> >
> > What is your opinion on this:
> > 1. We install the registry on all computers & servers.
> > 2. We install the registry ONLY on computers that have the eventID 6.
> >
> > Thank you.
> >
> > "rishicool2002" wrote:
> >
> >>
> >> Jose,
> >> You did the right thing by applying the registry only the client
> >> computer. This registry key is created on the machine, where the
> >> Kerberos events are logged.
> >> KB:935744, has complete explanation on this.
> >>
> >> Regards,
> >> Rishi
> >> Microsoft Server Support (Directory Services)
> >>
> >>
> >> --
> >> rishicool2002
> >> ------------------------------------------------------------ ------------
> >> rishicool2002's Profile: http://forums.techarena.in/members/114615.htm
> >> View this thread: http://forums.techarena.in/active-directory/1243111.htm
> >>
> >> http://forums.techarena.in
> >>
> >>
>
>
>
Re: MaxtokenSize Reached -> last clarification :) [message #160799 is a reply to message #160785] Tue, 08 September 2009 09:36 Go to previous messageGo to next message
jos  is currently offline jos
Messages: 20
Registered: August 2009
Junior Member
Very last question :)

in my previous command:

Name: Negotiate Comment: Microsoft Package Negotiator
Current PackageInfo->MaxToken: 65663
MaxTokenSize (incomplete context): 12372

12372 : is it the user's Token ?

many thx.

"josé" wrote:

> Thank u :)
>
> "Paul Bergson [MVP-DS]" wrote:
>
> > Yes you can increase the token size but I would look at why you have such a
> > token bloat issue. As the token increases logon times are going to
> > increase, etc... I would work to reduce the size, Microsoft made it the
> > size that it is for a reason. You are using to many groups, I don't see why
> > anyone should belong to 390 groups, that is the real problem here.
> >
> > --
> > Paul Bergson
> > MVP - Directory Services
> > MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> > 2008, 2003, 2000 (Early Achiever), NT4
> > Microsoft's Thrive IT Pro of the Month - June 2009
> >
> > http://www.pbbergs.com
> >
> > Please no e-mails, any questions should be posted in the NewsGroup This
> > posting is provided "AS IS" with no warranties, and confers no rights.
> >
> > "josé" <jos@discussions.microsoft.com> wrote in message
> > news:286ED661-2DA1-4D1C-B775-BB995B079CDA@microsoft.com...
> > > Hello Rishi :)
> > >
> > > Last question:
> > >
> > > What is your opinion on this:
> > > 1. We install the registry on all computers & servers.
> > > 2. We install the registry ONLY on computers that have the eventID 6.
> > >
> > > Thank you.
> > >
> > > "rishicool2002" wrote:
> > >
> > >>
> > >> Jose,
> > >> You did the right thing by applying the registry only the client
> > >> computer. This registry key is created on the machine, where the
> > >> Kerberos events are logged.
> > >> KB:935744, has complete explanation on this.
> > >>
> > >> Regards,
> > >> Rishi
> > >> Microsoft Server Support (Directory Services)
> > >>
> > >>
> > >> --
> > >> rishicool2002
> > >> ------------------------------------------------------------ ------------
> > >> rishicool2002's Profile: http://forums.techarena.in/members/114615.htm
> > >> View this thread: http://forums.techarena.in/active-directory/1243111.htm
> > >>
> > >> http://forums.techarena.in
> > >>
> > >>
> >
> >
> >
Re: MaxtokenSize Reached -> last clarification :) [message #160804 is a reply to message #160799] Tue, 08 September 2009 14:24 Go to previous messageGo to next message
pbbergs  is currently offline pbbergs  United States
Messages: 1024
Registered: July 2009
Senior Member
No, I believe that to be only what could be sent, hence the "Incomplete"
verbage.

http://www.microsoft.com/downloads/details.aspx?FamilyID=4a3 03fa5-cf20-43fb-9483-0f0b0dae265c&DisplayLang=en

--
Paul Bergson
MVP - Directory Services
MCTS, MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4
Microsoft's Thrive IT Pro of the Month - June 2009

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup This
posting is provided "AS IS" with no warranties, and confers no rights.

"josé" <jos@discussions.microsoft.com> wrote in message
news:A0B90336-2E28-426D-A652-E2F604D6DF87@microsoft.com...
> Very last question :)
>
> in my previous command:
>
> Name: Negotiate Comment: Microsoft Package Negotiator
> Current PackageInfo->MaxToken: 65663
> MaxTokenSize (incomplete context): 12372
>
> 12372 : is it the user's Token ?
>
> many thx.
>
> "josé" wrote:
>
>> Thank u :)
>>
>> "Paul Bergson [MVP-DS]" wrote:
>>
>> > Yes you can increase the token size but I would look at why you have
>> > such a
>> > token bloat issue. As the token increases logon times are going to
>> > increase, etc... I would work to reduce the size, Microsoft made it
>> > the
>> > size that it is for a reason. You are using to many groups, I don't
>> > see why
>> > anyone should belong to 390 groups, that is the real problem here.
>> >
>> > --
>> > Paul Bergson
>> > MVP - Directory Services
>> > MCTS, MCT, MCSE, MCSA, Security+, BS CSci
>> > 2008, 2003, 2000 (Early Achiever), NT4
>> > Microsoft's Thrive IT Pro of the Month - June 2009
>> >
>> > http://www.pbbergs.com
>> >
>> > Please no e-mails, any questions should be posted in the NewsGroup This
>> > posting is provided "AS IS" with no warranties, and confers no rights.
>> >
>> > "josé" <jos@discussions.microsoft.com> wrote in message
>> > news:286ED661-2DA1-4D1C-B775-BB995B079CDA@microsoft.com...
>> > > Hello Rishi :)
>> > >
>> > > Last question:
>> > >
>> > > What is your opinion on this:
>> > > 1. We install the registry on all computers & servers.
>> > > 2. We install the registry ONLY on computers that have the eventID 6.
>> > >
>> > > Thank you.
>> > >
>> > > "rishicool2002" wrote:
>> > >
>> > >>
>> > >> Jose,
>> > >> You did the right thing by applying the registry only the client
>> > >> computer. This registry key is created on the machine, where the
>> > >> Kerberos events are logged.
>> > >> KB:935744, has complete explanation on this.
>> > >>
>> > >> Regards,
>> > >> Rishi
>> > >> Microsoft Server Support (Directory Services)
>> > >>
>> > >>
>> > >> --
>> > >> rishicool2002
>> > >> ------------------------------------------------------------ ------------
>> > >> rishicool2002's Profile:
>> > >> http://forums.techarena.in/members/114615.htm
>> > >> View this thread:
>> > >> http://forums.techarena.in/active-directory/1243111.htm
>> > >>
>> > >> http://forums.techarena.in
>> > >>
>> > >>
>> >
>> >
>> >
Re: MaxtokenSize Reached -> last clarification :) [message #160830 is a reply to message #160804] Wed, 09 September 2009 01:54 Go to previous message
jos  is currently offline jos
Messages: 20
Registered: August 2009
Junior Member
Understood.

Thanx

"Paul Bergson [MVP-DS]" wrote:

> No, I believe that to be only what could be sent, hence the "Incomplete"
> verbage.
>
> http://www.microsoft.com/downloads/details.aspx?FamilyID=4a3 03fa5-cf20-43fb-9483-0f0b0dae265c&DisplayLang=en
>
> --
> Paul Bergson
> MVP - Directory Services
> MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> 2008, 2003, 2000 (Early Achiever), NT4
> Microsoft's Thrive IT Pro of the Month - June 2009
>
> http://www.pbbergs.com
>
> Please no e-mails, any questions should be posted in the NewsGroup This
> posting is provided "AS IS" with no warranties, and confers no rights.
>
> "josé" <jos@discussions.microsoft.com> wrote in message
> news:A0B90336-2E28-426D-A652-E2F604D6DF87@microsoft.com...
> > Very last question :)
> >
> > in my previous command:
> >
> > Name: Negotiate Comment: Microsoft Package Negotiator
> > Current PackageInfo->MaxToken: 65663
> > MaxTokenSize (incomplete context): 12372
> >
> > 12372 : is it the user's Token ?
> >
> > many thx.
> >
> > "josé" wrote:
> >
> >> Thank u :)
> >>
> >> "Paul Bergson [MVP-DS]" wrote:
> >>
> >> > Yes you can increase the token size but I would look at why you have
> >> > such a
> >> > token bloat issue. As the token increases logon times are going to
> >> > increase, etc... I would work to reduce the size, Microsoft made it
> >> > the
> >> > size that it is for a reason. You are using to many groups, I don't
> >> > see why
> >> > anyone should belong to 390 groups, that is the real problem here.
> >> >
> >> > --
> >> > Paul Bergson
> >> > MVP - Directory Services
> >> > MCTS, MCT, MCSE, MCSA, Security+, BS CSci
> >> > 2008, 2003, 2000 (Early Achiever), NT4
> >> > Microsoft's Thrive IT Pro of the Month - June 2009
> >> >
> >> > http://www.pbbergs.com
> >> >
> >> > Please no e-mails, any questions should be posted in the NewsGroup This
> >> > posting is provided "AS IS" with no warranties, and confers no rights.
> >> >
> >> > "josé" <jos@discussions.microsoft.com> wrote in message
> >> > news:286ED661-2DA1-4D1C-B775-BB995B079CDA@microsoft.com...
> >> > > Hello Rishi :)
> >> > >
> >> > > Last question:
> >> > >
> >> > > What is your opinion on this:
> >> > > 1. We install the registry on all computers & servers.
> >> > > 2. We install the registry ONLY on computers that have the eventID 6.
> >> > >
> >> > > Thank you.
> >> > >
> >> > > "rishicool2002" wrote:
> >> > >
> >> > >>
> >> > >> Jose,
> >> > >> You did the right thing by applying the registry only the client
> >> > >> computer. This registry key is created on the machine, where the
> >> > >> Kerberos events are logged.
> >> > >> KB:935744, has complete explanation on this.
> >> > >>
> >> > >> Regards,
> >> > >> Rishi
> >> > >> Microsoft Server Support (Directory Services)
> >> > >>
> >> > >>
> >> > >> --
> >> > >> rishicool2002
> >> > >> ------------------------------------------------------------ ------------
> >> > >> rishicool2002's Profile:
> >> > >> http://forums.techarena.in/members/114615.htm
> >> > >> View this thread:
> >> > >> http://forums.techarena.in/active-directory/1243111.htm
> >> > >>
> >> > >> http://forums.techarena.in
> >> > >>
> >> > >>
> >> >
> >> >
> >> >
>
>
>
Previous Topic:RODC - Legacy Client Support & DMZ Support
Next Topic:Read-Only domain controllers group
Goto Forum:
  


Current Time: Wed Jan 17 05:34:03 MST 2018

Total time taken to generate the page: 0.05101 seconds
.:: Contact :: Home ::Sitemap::.

Powered by: FUDforum 3.0.0RC2.
Copyright ©2001-2009 FUDforum Bulletin Board Software