When you use an account from an external Massachusetts Institute of Technology (MIT) Kerberos realm to log on to a Windows Vista-based workstation, the logon fails.

Note: You can use the same account to log on to a Windows XP-based workstation.

When a user belongs to many groups, that user may have problems with authentication or with Group Policy settings. The following Microsoft Knowledge Base articles describe these symptoms in more detail:

269643 Internet Explorer Kerberos authentication does not work because of an insufficient buffer connecting to IIS
280380 Buffer overflow exploit possible with extended stored procedures
The existing resolution that is described in these articles instructs you to modify the MaxTokenSize registry value. An improvement has been made to this resolution. If you use the hotfix that is described in this article, you may not have to edit the default MaxTokenSize value.

The hotfix that is described in this article supersedes the hotfixes that are described in Microsoft Knowledge Base articles that are listed in this section.