Article ID: 928273 - View products that this article applies to.
When a server is running Microsoft Internet Security and Acceleration (ISA) Server 2004, Enterprise Edition or Microsoft Internet Security and Acceleration (ISA) Server 2006, Enterprise Edition, users who access intranet Web sites may receive slow responses. Additionally, the domain controllers may receive excessive authentication requests from the computer that is running ISA Server.
This problem occurs if the following conditions are true:
This problem occurs because ISA Server passes incorrect authentication information to the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). Therefore, SPNEGO issues an invalid Kerberos ticket request. When SPNEGO cannot obtain a Kerberos ticket for the target server, it uses NTLM authentication. Because of the additional NTLM authentication requests, HTTP requests may generate very long response times.
To resolve this problem, obtain the latest ISA Server service pack. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/954258/ )How to obtain the latest Internet Security and Acceleration (ISA) Server 2006 service pack
(http://support.microsoft.com/kb/891024/ )How to obtain the latest ISA Server 2004 service pack
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
NTLM authentication puts additional load on the domain controller. This may cause remote procedure call (RPC) time-outs and Net Logon time-outs. The authentication delay causes slow response times.
The server may also fail over to another domain controller. If the other domain controller is not local, response times are even slower.
Disjoint namespacesWhen you use a primary domain name system (DNS) suffix that does not represent an Active Directory domain, the domain namespace is a disjoint namespace. For example, the following represents a disjoint namespace:
Active Directory domain: Domain1.comIn this example, the FQDN of the computer resembles the following:
Primary DNS suffix: Sub-domain.Domain1.com
Computer_Name.Sub-domain.Domain1.comHere, Sub-domain is not an Active Directory domain.
For more information about domain architecture, visit the following Microsoft Web site:
http://technet.microsoft.com/en-us/library/bb742583.aspxFor more information about the terms that are used to describe software updates, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/824684/ )Description of the standard terminology that is used to describe Microsoft software updates
Article ID: 928273 - Last Review: October 8, 2011 - Revision: 3.0