Article ID: 935744 - View products that this article applies to.
When you use a Microsoft Windows Server 2003-based domain controller to join a Microsoft Windows XP-based client computer to a domain, you may receive an error message that resembles the following on the client computer:
Additionally, the following Warning message may be logged in the System log on the client computer:
The following error occurred attempting to join the domain "domain_name.com": Not enough storage is available to complete this operation.
Event Type: Warning
This problem occurs because the Kerberos token that is generated during authentication is more than the fixed maximum size. In the original release version of Microsoft Windows 2000, the default value of the MaxTokenSize registry entry was 8,000 bytes. In Windows 2000 with Service Pack 2 (SP2) and in later versions of Windows, the default value of the MaxTokenSize registry entry is 12,000 bytes.
For example, if a user is a member of a group either directly or by membership in another group, the security ID (SID) for that group is added to the user's token. For a SID to be added to the user's token, the SID information must be communicated by using the Kerberos token. If the required SID information exceeds the size of the token, authentication is unsuccessful.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/322756/ )How to back up and restore the registry in Windows
To resolve this problem, increase the Kerberos token size. To do this, follow these steps on the client computer that logs the Kerberos event.
For more information about how to use the Tokensz tool to compute the maximum token size, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?familyid=4A303FA5-CF20-43FB-9483-0F0B0DAE265C&displaylang=enFor more information about how to address problems that occur because of access token limitations, visit the following Microsoft Web site:
http://www.microsoft.com/downloads/details.aspx?FamilyID=22dd9251-0781-42e6-9346-89d577a3e74a&DisplayLang=enFor more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/327825/ )New resolution for problems with Kerberos authentication when users belong to many groups
(http://support.microsoft.com/kb/263693/ )Group Policy may not be applied to users belonging to many groups
Article ID: 935744 - Last Review: February 4, 2008 - Revision: 2.1