Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am able to connect to the domain controller using the Active Directory Users and Computers mmc while logged in to a Windows XP or Windows Server 2003 computer, but get an Access Denied error when trying to connect to the same server while on any Windows 7.

The 2 other IT workers have the same issue. Each of us have no problem while on XP, just Windows 7, regardless of which Windows 7 computer it is (as we have tried multiple machines).

share|improve this question

migrated from superuser.com Mar 21 '13 at 15:54

This question came from our site for computer enthusiasts and power users.

    
Are the windows 7 machines actually on the domain, with the right product of windows? –  pjc50 Mar 20 '13 at 15:58
    
Yes these Windows 7 machines are located on the domain, as are the admin accounts used to connect to the domain controllers. Each account works on a Windows XP machine, but not Windows 7. "Access denied". –  Brenton Taylor Mar 20 '13 at 17:48
add comment

1 Answer

up vote 1 down vote accepted

We discovered the problem was that our accounts belonged to too many Active Directory groups and the Kerberos token size. A registry key needed to be created to increase the Kerberos fixed token size limit from 12000 to 65535.

This Technet forum post discusses the problem and this Microsoft KB article details the fix.

Registry fix required:

  1. Start Registry Editor (Regedt32.exe)

  2. Locate and click the following key in the registry System\CurrentControlSet\Control\Lsa\Kerberos\Parameters

  3. If this key is not present, create the key. To do so:
    a. Click the following key in the registry:
    System\CurrentControlSet\Control\Lsa\Kerberos
    b. On the Edit menu, click Add Key
    c. Create a Parameters key
    d. Click the new Parameters key

  4. On the Edit menu, click Add Value, and then add the following registry value Value name: MaxTokenSize
    Data type: REG_DWORD
    Radix: Decimal
    Value data: 65535

  5. Quit Registry Editor

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.