When NTLM load is detected using the MaxConcurrentApi NTLM Diagnostic one of four basic conditions will be reported on:
Delays from secure channel domain controller or trusted domain controller. This condition occurs when the delays are further along the secure channel, on another computer. This condition will have Semaphore Waiters, Semaphore Holders less than the number of MaxConcurrentApi, and Semaphore Timeouts.
Local computer MaxConcurrentApi load bottleneck. This condition occurs when the local computer is seeing more authentication load than it can service quickly enough. This condition will have Semaphore Waiters and Semaphore Timeouts.
Local computer MaxConcurrentApi delays for user authentication without timeout errors. This condition occurs when the local computers is seeing enough load to produce delays, or is seeing delays without errors from a domain controller. This condition will have Semaphore Waiters only.
Local computer MaxConcurrentApi timeout errors in the recent past. This condition occurs as a result of the Netlogon performance counters having evidence of past Semaphore Timeout errors however no current load while the diagnostic was running. This condition will have Semaphore Timeouts only.
If any of the conditions above are seen the diagnostic will wait 90 seconds and then gather a second sample of the Netlogon performance counters. The second sample will be compared to help determine whether a new MaxConcurrentApi setting should be recommended for that computer.
If no MaxConcurrentApi setting is suggested by the diagnostic then the performance data did not suggest an altered setting. If that occurs run the diagnostic when the issue is underway to see if a different suggested MaxConcurrentApi value is suggested.
NOTE: If Average Semaphore Hold Time is zero then the MaxConcurrentApi value should not be changed. Though the problem detection will not reveal the Netlogon performance counters which it used the same performance data is obtained in the SDP %computername%_MaxConcurrentApi.txt file.
More information can be found in the Knowledge Base articles below.
How to do performance tuning for NTLM authentication by using the MaxConcurrentApi setting
http://support.microsoft.com/kb/2688798You are intermittently prompted for credentials or experience time-outs when you connect to Authenticated Services
http://support.microsoft.com/kb/975363[SDP 3][52a5f43b-2db9-40b7-88ae-fd9842cca85f] MaxConcurrentApi NTLM Diagnostic
http://support.microsoft.com/kb/2709071