Note To learn more about the nonsecurity improvements and fixes in this update, see the "July 21, 2016 – KB3172614" section in Windows 8.1 and Windows Server 2012 R2 update history.
Issue 1
Symptoms
When a service such as Exchange server tries to reestablish the Kerberos client session during a cluster failover, it may cause the system to become unresponsive. Additionally, an LSASS CPU spike occurs after the failover.
Note This issue can occur on nonclustered environments also if there are many authentication requests occurring at the same time.
Resolution
Microsoft Windows has released a fix that contains new opt-in behavior for the Kerberos client to address this issue. By enabling the Kerberos parameter, the Kerberos client can bypass the CPU intensive action of purging compounded tickets.
Note The Kerberos client must opt-in for the new behavior. Follow these steps to create the registry parameter on each node of the cluster:
- In Registry Editor, locate and then select the following subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
- Right-click Parameters, point to New, and then click DWORD Value.
- Type AllowStaleDeviceAuthzData as the entry name, and then press Enter.
- Right-click AllowStaleDeviceAuthzData, and then click Modify.
- In the Value data box, type 1, and then click OK.
Note Setting this registry parameter may delay the purging and repopulating of compounding information that could cause changes in account permissions to not be reflected in real time.
For more information, see What's New in Kerberos Authentication.