Why am I getting HTTP 400 bad request errors when signing in ?

Question

I belong to many security groups, including several nested groups.

Some web applications return an HTTP 400 Bad Request error when I try to sign in.

I have read that this may be related to Kerberos token size limits and the MaxTokenSize setting.

Should I increase the MaxTokenSize registry value on my devices, and what value is recommended ?

Answer 1

Hello Adrian,

Your HTTP 400 errors may result from oversized Kerberos authentication tokens caused by extensive Active Directory group memberships, including nested groups. However, verify the root cause before changing the registry. On Windows 8 and Windows Server 2012 or later, the default "MaxTokenSize" is 48,000 bytes, which Microsoft recommends for most environments.

Check "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters\MaxTokenSize" and ensure the value is a "REG_DWORD". If the affected applications use IIS and return "Request Header Too Long," investigate the HTTP header limits "MaxFieldLength" and "MaxRequestBytes" under "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\HTTP\Parameters". Avoid increasing these limits indiscriminately, as doing so can increase memory consumption and security risks. The preferred long-term solution is to remove unnecessary group memberships and simplify nested group assignments. Also, check for Windows access-token limitations, since increasing "MaxTokenSize" will not resolve every group-membership-related issue.

For further guidance, consult Microsoft's documentation on "Kerberos authentication problems" (https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-authentication-problems-if-user-belongs-to-groups) and "HTTP 400 errors caused by oversized request headers" (https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/www-authentication-authorization/http-bad-request-response-kerberos).

Could you confirm the Windows versions involved, whether the applications run on IIS, and the exact HTTP 400 error message?

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

HP.

Answer 2

Yes. If the HTTP 400 occurs because the Kerberos ticket is too large, increasing MaxTokenSize is part of the fix.

This happens when a user belongs to many groups. Kerberos builds an authorization token that contains the user SID, group SIDs, and possibly sIDHistory and claims data. If that token is too large, authentication can fail, and web apps that use HTTP/IIS may return HTTP 400 Bad Request or Request Header Too Long.

Recommended value:

• For Windows Server 2012 and later, the default MaxTokenSize is 48,000 bytes.
• 48,000 bytes is also the recommended value for most implementations.
• Although the maximum allowed value is 65,535 bytes, setting MaxTokenSize above 48,000 is not recommended for HTTP/IIS scenarios because Kerberos tickets sent in HTTP are base64-encoded and expand to about 133% of their original size.

Important limits and guidance:

1. Set MaxTokenSize on each computer that participates in the Kerberos authentication process, including client devices. In multi-tier scenarios, that can also include web servers and back-end servers involved in delegated authentication.
2. The registry path is: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters
3. The value type is REG_DWORD.
4. A restart is required after changing it.
5. If MaxTokenSize is increased beyond 48,000, IIS may still fail because IIS/HTTP request buffer limits can be hit.

For IIS-based HTTP 400 errors, MaxTokenSize alone may not be enough. The IIS server may also need larger HTTP header limits:

• MaxFieldLength
• MaxRequestBytes

For Windows Server 2016 and later IIS systems, those are under: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\HTTP\Parameters

The documented sizing for those IIS-related values is:

• MaxFieldLength = (4/3 * T bytes) + 200
• MaxRequestBytes = (4/3 * T bytes) + 200

Where T is the Kerberos token size in bytes.

Risk warning: changing these registry values is potentially dangerous. Larger HTTP limits can increase memory usage in Http.sys and increase exposure to malicious traffic. Use the minimum value that resolves the issue.

Practical recommendation:

• If the affected systems are older than Windows Server 2012 / Windows 8-era defaults, set MaxTokenSize to 48,000 first.
• Do not raise it above 48,000 unless there is a clearly calculated requirement and the known IIS and protocol limitations have been reviewed.
• If the error is specifically HTTP 400 / Request Header Too Long in IIS-backed apps, review and size MaxFieldLength and MaxRequestBytes on the IIS server as well.

---

• Problems with Kerberos authentication when a user belongs to many groups
• Problems with Kerberos authentication when a user belongs to many groups
• Problems with Kerberos authentication when a user belongs to many groups
• How to use Group Policy to add the MaxTokenSize registry entry to multiple computers
• HTTP 400 Bad Request (Request Header too long) responses to HTTP requests
• HTTP 400 Bad Request (Request Header too long) responses to HTTP requests