Windows Tip Sheet

The Group that Broke the Camel’s Back

Belonging to too many domain user groups may actually prevent you from logging on.

A friend of mine who’s a network administrator recently complained that he was having logon issues on his network. Specifically, with his account, which obviously got top priority in his mind! He’s in a full-on Win2003 domain, so I didn’t understand at first what the problem could be, until we started talking. Sometimes his logon would work; other times, no dice, and it seemed completely random. We eliminated all the usual connectivity issues and were still stumped.

As you know, part of the logon process is generating a security token, which contains your user account’s security identifier (SID), as well as the SIDs for any groups you belong to. So whenever logon problems start to occur, I like to look at the token and see how it’s working. The Tokensz tool is perfect for this, so the next time his logon worked, I had him run it on his WinXP box.

Turns out my buddy’s user account is in a lot of domain user groups. A lot. Running Tokensz /compute_tokensize showed a token size of 11943, and the max is 12000. “Why so many groups?” I asked. Well, his company has a lot of groups, and whenever he created a new one, he put himself in it to test security access and stuff. Sometimes he’d remember to take himself back out of the group, but not always. When the number of groups he belonged to got too high (we put the number at about 80, but it depends on a lot of things), his token would get too large and he’d start having logon issues. Drop some groups, and all was well.

Nested group membership is worse, because it’s not apparent in the GUI how many groups you actually belong to, although each one’s SID goes into your token. Running Tokensz is the only real way to see your token and how large it’s growing. Once that 12,000-byte limit is passed (the byte limit, by the way, is the size of the buffer Kerberos uses to store pre-allocated certificates), problems begin. Some research turned up 70-120 as the range when problems begin to occur; keep your group membership under that level and you’ll be fine.

About the Author

Don Jones is a multiple-year recipient of Microsoft’s MVP Award, and is an Author/Evangelist for video training company Pluralsight. Don is also a co-founder and President of PowerShell.org, a community dedicated to Microsoft’s Windows PowerShell technology. Don has more than two decades of experience in the IT industry, and specializes in the Microsoft business technology platform. He’s the author of more than 50 technology books, an accomplished IT journalist, and a sought-after speaker and instructor at conferences worldwide. Reach Don on Twitter at @concentratedDon, or on Facebook at Facebook.com/ConcentratedDon.

comments powered by Disqus
Most   Popular

SharePoint Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.