DOCUMENT:Q297869  11-JUN-2002  [sms]
TITLE   :Issues After You Modify Kerberos MaxTokenSize Registry Value
PRODUCT :Microsoft Systems Management Server
PROD/VER::2.0 SP2,2.0 SP3
OPER/SYS:
KEYWORDS:kbnetwork kbsms200 w2000kerb kbKerberos

======================================================================
-------------------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Systems Management Server versions 2.0 SP2, 2.0 SP3 
-------------------------------------------------------------------------------

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

   Q256986 Description of the Microsoft Windows Registry

SYMPTOMS
========

After you apply post-Windows 2000 Service Pack 1 (SP1) fixes or Windows 2000
Service Pack 2 (SP2) and modify the Kerberos MaxTokenSize registry value,
various Systems Management Server (SMS) administrator issues may occur. The
following list provides examples of the types of issues you may experience:

 - When you create a package from definition, you may receive the following
   error message:

   Description: Wizard internal error: invalid WBEM ExecMethod result. Please
   exit the Wizard.
   HRESULT : 0x800706BF-The remote procedure call failed and did not execute.

 - When you try to create a new advertisement, you may receive the following
   error message:

   No properties are available on this object.

 - When you enumerate collections, you receive a list of Collection icons, but
   the collection name may be missing. For example, you may not see the "All
   Systems" name even though the typical icon is still displayed.

 - When browsing collections within the Advertisement Wizard, you may also
   receive the following error message:

   _com_error exception in MMC Admin UI!

CAUSE
=====

This issue can occur if the value for the MaxTokenSize value for Kerberos is set
too high.

WORKAROUND
==========

WARNING: If you use Registry Editor incorrectly, you may cause serious problems
that may require you to reinstall your operating system. Microsoft cannot
guarantee that you can solve problems that result from using Registry Editor
incorrectly. Use Registry Editor at your own risk.

To work around this issue, set the value of the MaxTokenSize value that is
located in the following registry key to a decimal value of less than 50,000:

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters

NOTE: By default, the MaxTokenSize value does not exist, and it must be added
manually.


Additional query words: prodsms

======================================================================
Keywords          : kbnetwork kbsms200 w2000kerb kbKerberos 
Technology        : kbSMSSearch kbSMS200SP2 kbSMS200SP3
Version           : :2.0 SP2,2.0 SP3
Issue type        : kbprb

=============================================================================

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS
PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS
ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES
OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO
EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR
ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,
CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF
MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION
OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES
SO THE FOREGOING LIMITATION MAY NOT APPLY.

Copyright Microsoft Corporation 2002.