You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/developer/webapps/iis/www-authentication-authorization/http-bad-request-response-kerberos.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,8 +34,7 @@ Decrease the number of Active Directory groups that the user is a member of.
34
34
35
35
Increase the settings for the `MaxFieldLength` and the `MaxRequestBytes` registry entries on the server so that the user's request headers don't exceed these values. To determine the appropriate settings, use the following calculations:
36
36
37
-
1. Calculate the size of the user's Kerberos token by using the formula described in the following article:
38
-
[Problems with Kerberos authentication when a user belongs to many groups](../../../../windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md).
37
+
1. Calculate the size of the user's Kerberos token by using the formula described in [Problems with Kerberos authentication when a user belongs to many groups](../../../../windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md).
39
38
40
39
2. Set the value of `MaxFieldLength` and `MaxRequestBytes` on the server to 4/3 * T bytes, where T is the user's token size in bytes. HTTP encodes the Kerberos token by using base64 encoding.
41
40
@@ -48,7 +47,8 @@ Depending on your application environment, you might also work around this probl
48
47
49
48
By default, there is no `MaxFieldLength` registry entry. This entry specifies the maximum size limit of each HTTP request header. The `MaxRequestBytes` registry entry specifies the upper limit for the total size of the Request line and the headers. Typically, this registry entry is configured together with the `MaxRequestBytes` registry entry. If the `MaxRequestBytes` value is lower than the `MaxFieldLength` value, the `MaxFieldLength` value is adjusted. In large Active Directory environments, users may experience logon failures if the values for both these entries aren't set to a sufficiently high value.
50
49
51
-
For IIS versions shipped with Windows Server 2016 and later, the `MaxFieldLength` and `MaxRequestBytes` registry keys are located at the following sub key:
50
+
For IIS versions shipped with Windows Server 2016 and later, the `MaxFieldLength` and `MaxRequestBytes` registry keys are located in the following subkey:
Set the key values as shown in the following table:
@@ -74,6 +74,6 @@ If `MaxFieldLength` is set to its maximum value of 64 KB, the `MaxTokenSize` reg
74
74
75
75
-[Http.sys registry settings for IIS](../iisadmin-service-inetinfo/httpsys-registry-windows.md)
76
76
77
-
-[Error logging in HTTP API](/windows/win32/http/error-logging-in-the-http-server-api)
77
+
-[Error logging in the HTTP server API](/windows/win32/http/error-logging-in-the-http-server-api)
78
78
79
79
-[Problems with Kerberos authentication when a user belongs to many groups](../../../../windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups.md)
0 commit comments