Warning for large Kerberos tickets
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Server 2012, Windows 8 or Windows RT
Path in the GPO console
Computer Configuration\Administrative Templates\System\KDC Description
This policy setting allows you to configure at what size Kerberos tickets will trigger the warning event issued during Kerberos authentication. The ticket size warnings are logged in the System log. If you enable this policy setting, you can set the threshold limit for Kerberos ticket which trigger the warning events. If set too high, then authentication failures might be occurring even though warning events are not being logged. If set too low, then there will be too many ticket warnings in the log to be useful for analysis. This value should be set to the same value as the Kerberos policy "Set maximum Kerberos SSPI context token buffer size" or the smallest MaxTokenSize used in your environment if you are not configuring using Group Policy. If you disable or do not configure this policy setting, the threshold value defaults to 12,000 bytes, which is the default Kerberos MaxTokenSize for Windows 7, Windows Server 2008 R2 and prior versions.
Registry
Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters Value name: EnableTicketSizeThreshold
Enabled: EnableTicketSizeThreshold = 1
Disabled: EnableTicketSizeThreshold = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/TicketSizeThreshold Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Warning for large Kerberos tickets
; State: Enabled
; Supported on: At least Windows Server 2012, Windows 8 or Windows RT
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters]
"EnableTicketSizeThreshold"=dword:00000001
"TicketSizeThreshold"=dword:00002ee0More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Warning for large Kerberos tickets
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EnableTicketSizeThreshold' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'TicketSizeThreshold' -Value 12000 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_kdc/TicketSizeThreshold
Data type: String
Value:
<enabled/>
<data id="TicketSizeThreshold" value="12000"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Warning for large Kerberos tickets
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters' -Name 'EnableTicketSizeThreshold' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters' -Name 'TicketSizeThreshold' -Expected 12000 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Warning for large Kerberos tickets
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EnableTicketSizeThreshold' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'TicketSizeThreshold' -Value 12000 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Warning for large Kerberos tickets
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Warning for large Kerberos tickets
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters' -Name 'EnableTicketSizeThreshold' -Expected 1 -Kind DWord)
(Test-RegistryValue -Path 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters' -Name 'TicketSizeThreshold' -Expected 12000 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Warning for large Kerberos tickets
# State: Enabled
# Supported on: At least Windows Server 2012, Windows 8 or Windows RT
$path = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\Policies\System\KDC\Parameters'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'EnableTicketSizeThreshold' -Value 1 -Type DWord
Set-ItemProperty -Path $path -Name 'TicketSizeThreshold' -Value 12000 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.