Skip to content

Commit d1d2c83

Browse files
authored
Docs 2024 Review: Update http-bad-request-response-kerberos.md
Updating IIS versions references
1 parent 83e6047 commit d1d2c83

1 file changed

Lines changed: 6 additions & 6 deletions

File tree

support/developer/webapps/iis/www-administration-management/http-bad-request-response-kerberos.md

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ Decrease the number of Active Directory groups that the user is a member of.
3535
Increase the settings for the `MaxFieldLength` and the `MaxRequestBytes` registry entries on the server so that the user's request headers don't exceed these values. To determine the appropriate settings, use the following calculations:
3636

3737
1. Calculate the size of the user's Kerberos token by using the formula described in the following article:
38-
[Problems with Kerberos authentication when a user belongs to many groups](https://support.microsoft.com/kb/327825).
38+
[Problems with Kerberos authentication when a user belongs to many groups](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups).
3939

4040
2. Set the value of `MaxFieldLength` and `MaxRequestBytes` on the server to 4/3 * T bytes, where T is the user's token size in bytes. HTTP encodes the Kerberos token by using base64 encoding.
4141

@@ -48,7 +48,7 @@ Depending on your application environment, you might also work around this probl
4848

4949
By default, there is no `MaxFieldLength` registry entry. This entry specifies the maximum size limit of each HTTP request header. The `MaxRequestBytes` registry entry specifies the upper limit for the total size of the Request line and the headers. Typically, this registry entry is configured together with the `MaxRequestBytes` registry entry. If the `MaxRequestBytes` value is lower than the `MaxFieldLength` value, the `MaxFieldLength` value is adjusted. In large Active Directory environments, users may experience logon failures if the values for both these entries aren't set to a sufficiently high value.
5050

51-
For IIS 6.0 and later, the `MaxFieldLength` and `MaxRequestBytes` registry keys are located at the following sub key:
51+
For IIS versions shipped with Windows Server 2016 and later, the `MaxFieldLength` and `MaxRequestBytes` registry keys are located at the following sub key:
5252
`HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters`
5353

5454
Set the key values as shown in the following table:
@@ -68,12 +68,12 @@ Set the key values as shown in the following table:
6868
> [!IMPORTANT]
6969
> Changing these registry keys should be considered to be extremely dangerous. These keys allow larger HTTP packets to be sent to IIS. This, in turn, may cause Http.sys to use more memory. Therefore, such changes can increase the computer's vulnerability to malicious attacks.
7070
71-
If `MaxFieldLength` is set to its maximum value of 64 KB, the `MaxTokenSize` registry value should be set to 3/4 * 64 = 48 KB. For more information about the `MaxTokenSize` setting, see [Problems with Kerberos authentication when a user belongs to many groups](https://support.microsoft.com/help/327825).
71+
If `MaxFieldLength` is set to its maximum value of 64 KB, the `MaxTokenSize` registry value should be set to 3/4 * 64 = 48 KB. For more information about the `MaxTokenSize` setting, see [Problems with Kerberos authentication when a user belongs to many groups](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups).
7272

7373
## References
7474

75-
- [Http.sys registry settings for IIS](https://support.microsoft.com/help/820129/http-sys-registry-settings-for-windows)
75+
- [Http.sys registry settings for IIS](https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/iisadmin-service-inetinfo/httpsys-registry-windows)
7676

77-
- [Error logging in HTTP API](https://support.microsoft.com/help/820729/error-logging-in-http-apis)
77+
- [Error logging in HTTP API](https://learn.microsoft.com/en-us/windows/win32/http/error-logging-in-the-http-server-api)
7878

79-
- [Problems with Kerberos authentication when a user belongs to many groups](https://support.microsoft.com/help/327825)
79+
- [Problems with Kerberos authentication when a user belongs to many groups](https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups)

0 commit comments

Comments
 (0)