Active Directory Cookbook for windows server 2003- P46:If you are familiar with the O'Reilly Cookbook format that can be seen in other popular books, such as the Perl Cookbook, Java Cookbook, and DNS and BIND Cookbook, then the layout of this book will not be anything new to you. The book is composed of 18 chapters, each containing 10-30 recipes for performing a specific Active Directory task. Within each recipe are four sections: problem, solution, discussion, and see also. | Run the following command to list your current tickets klist tickets Run the following command to purge your tickets klist purge Discussion Active Directory uses Kerberos as its preferred network authentication system. When you authenticate to a Kerberos Key Distribution Center KDC which in Active Directory terms is a domain controller you are issued one or more tickets. These tickets identify you as a certain principal in Active Directory and can be used to authenticate you to other Kerberized services. This type of ticket is known as a ticket-granting-ticket or TGT. Once you ve obtained a TGT the client can pass that to a Kerberized service and if the service accepts the ticket it will issue a service ticket that represents the client for the particular service. Kerberos is a fairly complicated system that cannot be done justice in a single paragraph. If you want more information on tickets and how the Kerberos authentication system works see Kerberos TheDefinitive Guide O Reilly . See Also RFC 1510 The Kerberos Network Authentication Service V5 and MS KB 232179 Kerberos Administration in Windows 2000 Recipe Forcing Kerberos to Use TCP Problem Clients are experiencing authentication problems and you ve determined it is due to UDP fragmentation of Kerberos traffic. You want to force Kerberos traffic to go over TCP instead. Solution Using a graphical user interface 1. Run from the command line or Start. Run. 2. In the left pane expand HKEY_LOCAL_MACHINE System CurrentControlSet . Control . Lsa. Kerberos. Parameters. 3. Right-click on Parameters and select New DWORD value. Enter MaxPacketSize for the value name. 4. In the right pane double-click on MaxPacketSize and enter 1. 5. Click OK. 461 Using a command-line interface reg add HKLM SYSTEM CurrentControlSet Control Lsa Kerberos Parameters v RETURN MaxPacketSize t REG_DWORD d 1 Using VBScript This code forces Kerberos to use TCP ------
