Updates from editor

Author: v-phoebh

support/developer/webapps/iis/www-authentication-authorization/http-bad-request-response-kerberos.md

@@ -7,14 +7,14 @@ ms.reviewer: ivanpash, paulboc
 ---
 # HTTP 400 Bad Request (Request Header too long) responses to HTTP requests
 
-When an HTTP request that contains a Kerberos authentication ticket is sent to a website that's hosted on Internet Information Services (IIS) and is configured to use Windows Integrated Authentication, the HTTP request header can have a considerable length that exceeds the maximum size for such headers accepted by the IIS server by default. This article helps you work around the HTTP 400 error that occurs when the HTTP request header is too long.
+When an HTTP request that contains a Kerberos authentication ticket is sent to a website that's hosted on Internet Information Services (IIS) and is configured to use Windows Integrated Authentication, the HTTP request header can have a considerable length that exceeds the maximum size of such headers accepted by the IIS server by default. This article helps you work around the HTTP 400 error that occurs when the HTTP request header is too long.
 
 _Original product version:_   Windows Server 2016  
 _Original KB number:_   2020943
 
 ## Symptoms
 
-When attempting to access a web application hosted on IIS (Internet Information Services) that requires Windows Integrated Authentication to grant users access to its resources, the client (browser) will submit an HTTP request that includes an authentication header (header name: Authorization) which will use either NTLM or Kerberos as authentication protocols. In the scenario where a Kerberos authentication token is sent from a browser to a website that's hosted on IIS, instead of receiving the expected webpage, you receive an error message that resembles the following one:
+When attempting to access a web application hosted on IIS that requires Windows Integrated Authentication to grant users access to its resources, the client (browser) will submit an HTTP request that includes an authentication header (header name: `Authorization`) that uses either NTLM or Kerberos as authentication protocols. In the scenario where a Kerberos authentication token is sent from a browser to a website that's hosted on IIS, instead of receiving the expected webpage, you receive an error message that resembles the following one:
 
 > HTTP 400 - Bad Request (Request header too long)
 
@@ -24,7 +24,7 @@ This response could be generated by any HTTP request that includes Windows Remot
 
 This issue may occur if the user is a member of many Active Directory user groups.
 
-The HTTP request to the server contains the Kerberos token in the `Authorize` header. The size of the Kerberos token contained within the HTTP header increases together with the number of user groups for the authenticating user. If the HTTP header or packet size increases past the limits that are configured on the server, the server may reject the request and send an error message as the response.
+The HTTP request to the server contains the Kerberos token in the `Authorize` header. The size of the Kerberos token contained within the HTTP header increases together with the number of user groups used to authenticate users. If the HTTP header or packet size increases past the limits that are configured on the server, the server may reject the request and send an error message as the response.
 
 ## Workaround 1: Decrease the number of Active Directory groups
 
@@ -39,15 +39,15 @@ Increase the settings for the `MaxFieldLength` and the `MaxRequestBytes` registr
 2. Set the value of `MaxFieldLength` and `MaxRequestBytes` on the server to 4/3 * T bytes, where T is the user's token size in bytes. HTTP encodes the Kerberos token by using base64 encoding.
 
    > [!NOTE]
-   > This replaces every three bytes in the token with four base64-encoded bytes. Changes that are made to the registry do not take effect until you restart the HTTP service. Additionally, you will need to restart any related services, such as IIS services.
+   > This replaces every three bytes in the token with four base64-encoded bytes. Changes that are made to the registry don't take effect until you restart the HTTP service. Additionally, you'll need to restart any related services, such as IIS services.
 
 Depending on your application environment, you might also work around this problem by configuring the website to use Windows NT LAN Manager (NTLM) instead of Kerberos. Some application environments require Kerberos authentication to be used for delegation. We consider Kerberos authentication to be more secure than NTLM. And we recommend that you don't disable Kerberos authentication before you consider the security and delegation ramifications.
 
 ## More information
 
-By default, there is no `MaxFieldLength` registry entry. This entry specifies the maximum size limit of each HTTP request header. The `MaxRequestBytes` registry entry specifies the upper limit for the total size of the Request line and the headers. Typically, this registry entry is configured together with the `MaxRequestBytes` registry entry. If the `MaxRequestBytes` value is lower than the `MaxFieldLength` value, the `MaxFieldLength` value is adjusted. In large Active Directory environments, users may experience logon failures if the values for both these entries aren't set to a sufficiently high value.
+By default, there's no `MaxFieldLength` registry entry. This entry specifies the maximum size limit of each HTTP request header. The `MaxRequestBytes` registry entry specifies the upper limit for the total size of the Request line and the headers. Typically, this registry entry is configured together with the `MaxRequestBytes` registry entry. If the `MaxRequestBytes` value is lower than the `MaxFieldLength` value, the `MaxFieldLength` value is adjusted. In large Active Directory environments, users may experience logon failures if the values for both these entries aren't set to a sufficiently high value.
 
-The size of `MaxFieldLength` and `MaxRequestBytes` shouldn't exceed the maximum allowed values for these fields which are defined [here](https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/health-diagnostic-performance/httpsys-registry-windows) 
+The size of `MaxFieldLength` and `MaxRequestBytes` shouldn't exceed the maximum allowed values for these fields that are defined in [Http.sys registry settings for Windows](/troubleshoot/developer/webapps/iis/health-diagnostic-performance/httpsys-registry-windows). 
 
 For IIS versions shipped with Windows Server 2016 and later, the `MaxFieldLength` and `MaxRequestBytes` registry keys are located in the following subkey: