Share via

Active Directory Kerberos ticket size expansion causing authentication failures for multi-group corporate users

Mei Lin 0 Reputation points
2026-06-09T06:54:43.2166667+00:00

Hi admins, we have several senior business analysts who are suddenly unable to log into internal corporate resources, hitting HTTP 400 Bad Request screens on intranet portals. I suspect their user accounts belong to so many Active Directory security groups that their Kerberos token size has expanded past the default buffer threshold.

Thanks!

Windows for business | Windows 365 Business
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Quinnie Quoc 11,400 Reputation points Independent Advisor
    2026-06-09T08:12:38.73+00:00

    Hello Mei Lin,

    You are correct in suspecting Kerberos token bloat. When a user account is a member of too many Active Directory security groups, the PAC data in the Kerberos ticket exceeds the default MaxTokenSize, which results in HTTP 400 Bad Request errors on IIS or other intranet portals. By default, Windows sets MaxTokenSize to 48,000 bytes, but in practice IIS and certain applications fail once the token grows beyond ~12,000–16,000 bytes.

    The immediate remediation is to adjust the registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\MaxTokenSize to a higher value, for example 65535, and then reboot the affected servers. At the same time, you should review group memberships for the impacted users, since excessive nested groups are the root cause and can lead to performance and authentication issues across multiple services. Microsoft’s best practice is to keep group memberships lean and avoid unnecessary nesting.

    If my answer is useful for you, please hit Accept the answer to support me.

    Thank you,

    QQ.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.