Windows Remote Management (WinRM) does not accept HTTP authorization requests that are larger than 16 KB on a computer that is running Windows Server 2008 or Windows Vista
You have Windows Remote Management (WinRM) installed on a
computer that is running Windows Server 2008 or Windows Vista.
You have a user security token that is larger than 16 KB
because of the domain configuration.
Note The size of the user security token grows together with the
number of groups to which the user belongs.
You start a WinRM operation from this computer. Or, you use
another application that uses WinRM for communication, such as Microsoft System
Center Virtual Machine Manager.
In this scenario, the operation fails and you receive following
error code:
0x803380f7
Additionally, the
following event is logged in the System log:
Log
Name: System Source: Microsoft-Windows-Security-Kerberos Date:
Date & Time Event
ID: 6 Task Category: None Level: Warning Keywords: Classic
User: N/A Computer: Computer
Name Description: The kerberos SSPI package generated an
output token of size number bytes, which was too
large to fit in the token buffer of size number
bytes, provided by process id number. The output
SSPI token being too large is probably the result of the user user
name being a member of a large number of groups. It is
recommended to minimize the number of groups a user belongs to. If the problem
can not be corrected by reduction of the group memberships of this user, please
contact your system administrator to increase the maximum token size, which in
term is configured machine-wide via the following registry value:
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\MaxTokenSize.
If
you run command "winrm identify -remote:
<name-of-remote-machine>" at the command
prompt, you will receive the follwoing error message:
WSManFault
Message = WinRM cannot process the request. An error occured while using the following authentication method: Kerberos. Possible causes are:
The user name or password specified are invalid.
Kerberos is used when no authentication method and no user name are specified.
Kerberos does not accept a local user name.
The Service Principal Name (SPN) for the remote computer name and port does not exist.
The client and remote computers are in different domains and there is no trust between the two domains.
You may check the Event Viewer for events related to authentication.
To continue using the same authentication method, check and resolve the issues above.
To use a different authentication method, specify a valid user name and password and do one of the following: add the destination computer to the TrustedHosts configuration setting for WinRM or use HTTPS transport. You can get information about the WinRM configuration by running the following command: winrm help config.
Error number: -2147024843 0x80070035
The network path was not found.
In some domain environments, the user security token that is
used to authenticate the user to the server may be larger than 16 KB. This can
occur when a user is a member of many security groups.
However, WinRM
has a 16 KB size limit for HTTP authorization requests. Therefore, WinRM does
not accept HTTP authorization requests that use a user security token that is
larger than 16 KB.
A hotfix is available to resolve this issue. After you apply
this hotfix, you can customize the values of MaxFieldLength and MaxRequestBytes
registry entries to make WinRM accept authorization requests larger than 16 KB.
Hotfix information
A
supported hotfix is available from Microsoft. However, this hotfix is intended
to correct only the problem that is described in this article. Apply this
hotfix only to systems that are experiencing this specific problem. This hotfix
might receive additional testing. Therefore, if you are not severely affected
by this problem, we recommend that you wait for the next software update that
contains this hotfix.
If the hotfix is available for download, there
is a "Hotfix download available" section at the top of this Knowledge Base
article. If this section does not appear, contact Microsoft Customer Service
and Support to obtain the hotfix.
Note If additional issues occur or if any troubleshooting is required,
you might have to create a separate service request. The usual support costs
will apply to additional support questions and issues that do not qualify for
this specific hotfix. For a complete list of Microsoft Customer Service and
Support telephone numbers or to create a separate service request, visit the
following Microsoft Web site:
Note The "Hotfix download available" form displays the languages for
which the hotfix is available. If you do not see your language, it is because a
hotfix is not available for that language.
Important Windows Vista
and Windows Server 2008 hotfixes are included in the same packages. However,
only one of these products may be listed on the “Hotfix Request” page. To
request the hotfix package that applies to both Windows Vista and Windows
Server 2008, just select the product that is listed on the page.
Prerequisites
To apply this hotfix, your computer must be running one of the
following operating systems:
Windows Vista Service Pack 1
Windows Vista Service Pack 2
Windows Server 2008
Windows Server 2008 Service Pack 2
Restart requirement
You must restart the computer after you apply this hotfix.
Hotfix replacement information
This hotfix does not replace any other previously released
hotfixes.
Registry information
After you apply this hotfix, you can customize the following two
registry entries to make WinRM accept authorization requests larger than
16KB.
The MaxFieldLength registry entry
Name: MaxFieldLength
TYPE: REG_DWORD
Value: default (16384). Range (64 to 65534)
Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
Explanation: The MaxFieldLength registry entry specifies the maximum size limit of each HTTP request header in byte.
The MaxRequestBytes registry entry
Name: MaxRequestBytes
Type: REG_DWORD
Value: default (16384). Range (64 to 65534)
Location: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters
Explanation: The MaxRequestBytes registry entry specifies the upper limit for the total size of the Request line and the headers in byte.
Typically, the MaxFieldLength registry entry is configured
together with the MaxRequestBytes registry entry. If the MaxRequestBytes value
is less than the MaxFieldLength value, the MaxFieldLength value is
adjusted.
For more information about the Http.sys registry settings, click
the following article number to view the article in the Microsoft Knowledge
Base:
The English version of this hotfix has the file
attributes (or later file attributes) that are listed in the following table.
The dates and times for these files are listed in Coordinated Universal Time
(UTC). When you view the file information, it is converted to local time. To
find the difference between UTC and local time, use the Time
Zone tab in the Date and Time item in Control
Panel.
Windows Vista and Windows Server 2008 file information note
The MANIFEST files (.manifest) and the MUM files (.mum) that
are installed for each environment are listed separately. MUM and MANIFEST files, and
the associated security catalog (.cat) files, are critical to maintaining the
state of the updated component. The security catalog files (attributes not
listed) are signed with a Microsoft digital signature.
For all supported x86-based versions of Windows Vista and of Windows Server 2008
Collapse this tableExpand this table
File name
File version
File
size
Date
Time
Platform
SP requirement
Winrm.cmd
Not
Applicable
35
01-Apr-2009
19:13
Not
Applicable
SP1
Winrm.vbs
Not
Applicable
195,122
01-Apr-2009
19:13
Not
Applicable
SP1
Wsmanhttpconfig.exe
6.0.6001.22432
30,720
13-May-2009
12:42
x86
SP1
Wsmanmigrationplugin.dll
6.0.6001.22432
188,928
13-May-2009
14:53
x86
SP1
Wsmauto.dll
6.0.6001.22432
123,904
13-May-2009
14:53
x86
SP1
Wsmauto.mof
Not
Applicable
4,430
01-Apr-2009
19:13
Not
Applicable
SP1
Wsmcl.dll
6.0.6001.22432
1,536
13-May-2009
14:53
x86
SP1
Wsmprov.dll
6.0.6001.22432
55,296
13-May-2009
14:53
x86
SP1
Wsmpty.xsl
Not
Applicable
1,559
01-Apr-2009
19:13
Not
Applicable
SP1
Wsmres.dll
6.0.6001.22432
13,312
13-May-2009
12:42
x86
SP1
Wsmsvc.dll
6.0.6001.22432
748,544
13-May-2009
14:53
x86
SP1
Wsmtxt.xsl
Not
Applicable
2,178
01-Apr-2009
19:13
Not
Applicable
SP1
Wsmwmipl.dll
6.0.6001.22432
176,128
13-May-2009
14:53
x86
SP1
Winrm.cmd
Not
Applicable
35
03-Apr-2009
21:49
Not
Applicable
SP2
Winrm.vbs
Not
Applicable
195,122
03-Apr-2009
21:49
Not
Applicable
SP2
Wsmanhttpconfig.exe
6.0.6002.22135
30,720
13-May-2009
12:28
x86
SP2
Wsmanmigrationplugin.dll
6.0.6002.22135
188,928
13-May-2009
12:28
x86
SP2
Wsmauto.dll
6.0.6002.22135
123,904
13-May-2009
12:28
x86
SP2
Wsmauto.mof
Not
Applicable
4,430
03-Apr-2009
21:49
Not
Applicable
SP2
Wsmcl.dll
6.0.6002.22135
1,536
13-May-2009
12:27
x86
SP2
Wsmprov.dll
6.0.6002.22135
55,296
13-May-2009
12:28
x86
SP2
Wsmpty.xsl
Not
Applicable
1,559
03-Apr-2009
21:49
Not
Applicable
SP2
Wsmres.dll
6.0.6002.22135
13,312
13-May-2009
12:27
x86
SP2
Wsmsvc.dll
6.0.6002.22135
748,544
13-May-2009
14:45
x86
SP2
Wsmtxt.xsl
Not
Applicable
2,178
03-Apr-2009
21:49
Not
Applicable
SP2
Wsmwmipl.dll
6.0.6002.22135
176,128
13-May-2009
12:28
x86
SP2
For all supported x64-based versions of Windows Vista and of Windows Server 2008
Collapse this tableExpand this table
File name
File version
File
size
Date
Time
Platform
SP
requirement
Service branch
Winrm.cmd
Not
Applicable
35
01-Apr-2009
16:43
Not
Applicable
SP1
Not Applicable
Winrm.vbs
Not
Applicable
195,122
01-Apr-2009
16:43
Not
Applicable
SP1
Not Applicable
Wsmanhttpconfig.exe
6.0.6001.22432
31,232
13-May-2009
13:02
x64
SP1
Not
Applicable
Wsmanmigrationplugin.dll
6.0.6001.22432
252,928
13-May-2009
15:09
x64
SP1
Not
Applicable
Wsmauto.dll
6.0.6001.22432
161,792
13-May-2009
15:09
x64
SP1
Not
Applicable
Wsmauto.mof
Not
Applicable
4,430
01-Apr-2009
16:43
Not
Applicable
SP1
Not Applicable
Wsmcl.dll
6.0.6001.22432
1,536
13-May-2009
15:09
x64
SP1
Not
Applicable
Wsmprov.dll
6.0.6001.22432
73,216
13-May-2009
15:09
x64
SP1
Not
Applicable
Wsmpty.xsl
Not
Applicable
1,559
01-Apr-2009
16:43
Not
Applicable
SP1
Not Applicable
Wsmres.dll
6.0.6001.22432
13,312
13-May-2009
13:02
x64
SP1
Not
Applicable
Wsmsvc.dll
6.0.6001.22432
1,093,632
13-May-2009
15:09
x64
SP1
Not
Applicable
Wsmtxt.xsl
Not
Applicable
2,178
01-Apr-2009
16:43
Not
Applicable
SP1
Not Applicable
Wsmwmipl.dll
6.0.6001.22432
284,672
13-May-2009
15:09
x64
SP1
Not
Applicable
Winrm.cmd
Not
Applicable
35
01-Apr-2009
19:13
Not
Applicable
SP1
WOW
Winrm.vbs
Not
Applicable
195,122
01-Apr-2009
19:13
Not
Applicable
SP1
WOW
Wsmanhttpconfig.exe
6.0.6001.22432
30,720
13-May-2009
12:42
x86
SP1
WOW
Wsmanmigrationplugin.dll
6.0.6001.22432
188,928
13-May-2009
14:53
x86
SP1
WOW
Wsmauto.dll
6.0.6001.22432
123,904
13-May-2009
14:53
x86
SP1
WOW
Wsmauto.mof
Not
Applicable
4,430
01-Apr-2009
19:13
Not
Applicable
SP1
WOW
Wsmcl.dll
6.0.6001.22432
1,536
13-May-2009
14:53
x86
SP1
WOW
Wsmprov.dll
6.0.6001.22432
55,296
13-May-2009
14:53
x86
SP1
WOW
Wsmpty.xsl
Not
Applicable
1,559
01-Apr-2009
19:13
Not
Applicable
SP1
WOW
Wsmres.dll
6.0.6001.22432
13,312
13-May-2009
12:42
x86
SP1
WOW
Wsmsvc.dll
6.0.6001.22432
748,544
13-May-2009
14:53
x86
SP1
WOW
Wsmtxt.xsl
Not
Applicable
2,178
01-Apr-2009
19:13
Not
Applicable
SP1
WOW
Wsmwmipl.dll
6.0.6001.22432
176,128
13-May-2009
14:53
x86
SP1
WOW
Winrm.cmd
Not
Applicable
35
03-Apr-2009
21:08
Not
Applicable
SP2
Not Applicable
Winrm.vbs
Not
Applicable
195,122
03-Apr-2009
21:08
Not
Applicable
SP2
Not Applicable
Wsmanhttpconfig.exe
6.0.6002.22135
31,232
13-May-2009
12:41
x64
SP2
Not
Applicable
Wsmanmigrationplugin.dll
6.0.6002.22135
252,928
13-May-2009
14:47
x64
SP2
Not
Applicable
Wsmauto.dll
6.0.6002.22135
161,792
13-May-2009
14:47
x64
SP2
Not
Applicable
Wsmauto.mof
Not
Applicable
4,430
03-Apr-2009
21:08
Not
Applicable
SP2
Not Applicable
Wsmcl.dll
6.0.6002.22135
1,536
13-May-2009
12:41
x64
SP2
Not
Applicable
Wsmprov.dll
6.0.6002.22135
73,216
13-May-2009
14:47
x64
SP2
Not
Applicable
Wsmpty.xsl
Not
Applicable
1,559
03-Apr-2009
21:08
Not
Applicable
SP2
Not Applicable
Wsmres.dll
6.0.6002.22135
13,312
13-May-2009
12:41
x64
SP2
Not
Applicable
Wsmsvc.dll
6.0.6002.22135
1,093,632
13-May-2009
14:47
x64
SP2
Not
Applicable
Wsmtxt.xsl
Not
Applicable
2,178
03-Apr-2009
21:08
Not
Applicable
SP2
Not Applicable
Wsmwmipl.dll
6.0.6002.22135
284,672
13-May-2009
14:47
x64
SP2
Not
Applicable
Winrm.cmd
Not
Applicable
35
03-Apr-2009
21:49
Not
Applicable
SP2
WOW
Winrm.vbs
Not
Applicable
195,122
03-Apr-2009
21:49
Not
Applicable
SP2
WOW
Wsmanhttpconfig.exe
6.0.6002.22135
30,720
13-May-2009
12:28
x86
SP2
WOW
Wsmanmigrationplugin.dll
6.0.6002.22135
188,928
13-May-2009
12:28
x86
SP2
WOW
Wsmauto.dll
6.0.6002.22135
123,904
13-May-2009
12:28
x86
SP2
WOW
Wsmauto.mof
Not
Applicable
4,430
03-Apr-2009
21:49
Not
Applicable
SP2
WOW
Wsmcl.dll
6.0.6002.22135
1,536
13-May-2009
12:27
x86
SP2
WOW
Wsmprov.dll
6.0.6002.22135
55,296
13-May-2009
12:28
x86
SP2
WOW
Wsmpty.xsl
Not
Applicable
1,559
03-Apr-2009
21:49
Not
Applicable
SP2
WOW
Wsmres.dll
6.0.6002.22135
13,312
13-May-2009
12:27
x86
SP2
WOW
Wsmsvc.dll
6.0.6002.22135
748,544
13-May-2009
14:45
x86
SP2
WOW
Wsmtxt.xsl
Not
Applicable
2,178
03-Apr-2009
21:49
Not
Applicable
SP2
WOW
Wsmwmipl.dll
6.0.6002.22135
176,128
13-May-2009
12:28
x86
SP2
WOW
For all supported Itanium-based versions of Windows Server 2008