Authentication

Authentication

The following sections contain customizations that help you troubleshoot and optimize authentication. The section “Configuring Kerberos” describes how to configure Kerberos for troubleshooting. The section “Disabling Global Catalog Requirement” describes how to remove the requirement of having a Global Catalog server at remote sites. Finally, the section “Enabling Verbose Winlogon Messages” describes how you can get more information from Winlogon for troubleshooting.

Configuring Kerberos

Kerberos is an authentication mechanism that is used to verify user or host identity. Kerberos is the preferred authentication method for services in Windows Server 2003. If you are running Windows Server 2003, you can modify Kerberos parameters to help troubleshoot Kerberos authentication issues or to test the Kerberos protocol. After you finish troubleshooting or testing the Kerberos protocol, remove any registry entries that you added. Otherwise, your computer's performance might be affected.

Table 6-1 describes the values you can configure in the key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters and that are REG_DWORD values.

Table 6-1 Control\ Lsa\Kerberos\Parameters

Name	Value	Description
SkewTime	5 (minutes)	This value is the maximum time difference that is permitted between the client computer and the server that accepts Kerberos authentication. In Windows Server 2003 checked build version, the default SkewTime value is two hours. A checked build version–also known as a debug version–of the Windows operating system is used in production and testing environments. This kind of build helps trace the cause of problems in system software by turning on many debugging checks in the operating system code and in the system drivers. These debugging checks help the checked build identify internal inconsistencies as soon as they occur. A checked build has many compiler optimizations turned off and is larger and runs more slowly than an end-user version of Windows does. An end-user version of Windows is also known as a free build version or a retail-build version. In a free build version, debugging information is removed, and Windows is built with full compiler optimizations. A free build version is also faster and uses less memory than a checked build version does.
LogLevel	0	This value indicates whether events are logged in the system event log. If this value is set to any non-zero value, all Kerberos-related events are logged in the system event log.
MaxPacketSize	1465 (bytes)	This value is the maximum User Datagram Protocol (UDP) packet size. If the packet size exceeds this value, TCP is used.
StartupTime	120 (seconds)	This value is the time that Windows waits for the Key Distribution Center (KDC) to start before Windows gives up.
KdcWaitTime	10 (seconds)	This value is the time Windows waits for a response from a KDC.
KdcBackoffTime	10 (seconds)	This value is the time between successive calls to the KDC if the previous call failed.
KdcSendRetries	3	This value is the number of times that a client will try to contact a KDC.
DefaultEncryptionType	23 (decimal) or 0x17 (hexadecimal)	This value indicates the default encryption type for pre-authentication.
FarKdcTimeout	10 (minutes)	This is the time-out value that is used to invalidate a domain controller from a different site in the domain controller cache.
NearKdcTimeout	30 (minutes)	This is the time-out value that is used to invalidate a domain controller in the same site in the domain controller cache.
StronglyEncrypt-Datagram	FALSE	This value contains a flag that indicates whether to use 128-bit encryption, as opposed to weaker encryption, for datagram packets.
MaxReferralCount	6	This value is the number of KDC referrals that a client pursues before the client gives up.
KerbDebugLevel	1 (for Windows Server 2003 checked build version), 0 (for Windows Server free build version)	This value indicates whether debug logging is on (1) or off (0).
MaxTokenSize	12000 (Decimal)	This value is the maximum value of the Kerberos token. Microsoft recommends that you set this value to less than 65535.
SpnCacheTimeout	15 (minutes)	This value is the lifetime of the Service Principal Names (SPN) cache entries. On domain controllers, the SPN cache is disabled.
S4UCacheTimeout	15 (minutes)	This value is the lifetime of the S4U negative cache entries that are used to restrict the number of S4U proxy requests from a particular computer.
S4UTicketLifetime	15 (minutes)	This value is the lifetime of tickets that are obtained by S4U proxy requests.
RetryPdc	0 (false) Possible values: 0 (false) or any non-zero value (true)	This value indicates whether the client will contact the primary domain controller for Authentication Service Requests (AS_REQ) if the client receives a password expiration error.
RequestOptions	Any RFC 1510 value	This value indicates whether there are additional options that must be sent as KDC options in Ticket Granting Service requests (TGS_REQ).
ClientIpAddress	0 Possible values: 0 (false) or any non-zero value (true). (This setting is 0 because of Dynamic Host Configuration Protocol and network address translation issues.)	This value indicates whether a client IP address will be added in AS_REQ to force the Caddr field to contain IP addresses in all tickets.
TgtRenewalTime	600 (seconds)	This value is the time that Kerberos waits before it tries to renew a Ticket Granting Ticket (TGT) before the ticket expires.
AllowTgtSessionKey	0 Possible values: 0 (false) or any non-zero value (true)	This value indicates whether session keys are exported with initial or with cross realm TGT authentication. The default value is false for security reasons.

Table 6-2 describes the values that you can configure in the key HKLM\SYSTEM\CurrentControlSet\Services\Kdc. (Create the subkey Kdc if it doesn't exist.)

Table 6-2 Services\ Kdc

Name	Value	Description
KdcUseClientAddresses	0 Possible values: 0 (false) or any non-zero value (true)	This value indicates whether IP addresses will be added in the Ticket Granting Service Reply (TGS_REP).
KdcDontCheckAddresses	0 Possible values: 0 (false) or any non-zero value (true)	This value indicates whether IP addresses for the TGS_REQ and the TGT Caddr field will be checked.
NewConnectionTimeout	50 (seconds)	This value is the time that an initial TCP endpoint connection will be kept open to receive data before it disconnects.
MaxDatagramReplySize	1465 (decimal, bytes)	This value is the maximum UDP packet size in TGS_REP and Authentication Service Reply (AS_REP) messages. If the packet size exceeds this value, the KDC returns a KRB_ERR_RESPONSE_TOO_BIG message that requests that the client switch to TCP.
KdcExtraLogLevel	2 Possible values: 1 (decimal) or 0x1 (hexadecimal): Audit SPN unknown errors. 2 (decimal) or 0x2 (hexadecimal): Log PKINIT errors. (PKINIT is an Internet Engineering Task Force [IETF] Internet draft for “Public Key Cryptography for Initial Authentication in Kerberos.”) 4 (decimal) or 0x4 (hexadecimal): Log all KDC errors.	This value indicates what information the KDC will write to event logs and to audits.
KdcDebugLevel	1 (for checked build), 0 (for free build)	This value indicates whether debug logging is on (1) or off (0). If the value is set to 0x10000000 (hexadecimal) or 268435456 (decimal), specific file or line information will be returned in the data field of KERB_ERRORS as PKERB_EXT_ERROR errors during a KDC processing failure.

Disabling Global Catalog Requirement

Placement of Global Catalog servers in remote sites is usually desired to improve performance of user logon time, searches, and other actions requiring communication with Global Catalog servers, and to reduce wide area network (WAN) traffic. However, to reduce administrative intervention, hardware requirements, and other related overhead, you might not always want to locate a Global Catalog server at a remote site. This is especially relevant in environments that have a large number of sites that could experience substantially increased hardware costs when the size of the sites might not justify that hardware and administration. The problem is that logons require the domain controller authenticating the user to contact a Global Catalog server to determine whether the user is a member of any universal groups. If the remote office does not have a Global Catalog server and a Global Catalog server cannot be contacted (for various reasons), then the user's logon request might fail (based on the rules stated earlier).

Windows Server 2003 offers an alternative to universal group caching. When this is enabled for a site, users who log on while a Global Catalog server is online can continue to do so if the Global Catalog server is inaccessible at the next logon.

To eliminate the need for a Global Catalog server at a site and to avoid potential denial of user logon requests, enable logons when a Global Catalog server is not available. You must configure this setting on the domain controller that performs the user authentication. To do that, add the REG_DWORD value IgnoreGCFailures to HKLM\SYSTEM\CurrentControlSet\Control\Lsa. Set this value to 0x01. After changing this value, you must restart the domain controller.

CAUTION
The universal groups setting causes potential security vulnerabilities. Universal groups should not be used because if a user is a member of a universal group and the group is denied access to a resource, the key turns off enumeration of universal groups. The result is that the universal group SID is not added to the user's token, and the user could have access to the resource.

Enabling Verbose Winlogon Messages

You can configure Windows so that you receive verbose startup, shutdown, logon, and logoff status messages. Verbose status messages might be helpful when you are troubleshooting slow startup, shutdown, logon, or logoff behavior. To enable verbose status messages, create the REG_DWORD value verbosestatus in the key HLKM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Set this value to 0x01. Note that Windows doesn't display status messages if the value DisableStatusMessages exists in the key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System.