0100100101010100

Source: Kerberos
Event ID: 6
Type: Warning
Description: The Kerberos SSPI package generated an output token of size 2F49 bytes, which was too large to fit in the 2F48 buffer buffer provided by process id 0.  If the condition persists, please contact your system administrator.

If you get message up, you perhaps need to increase limit of kerberos ticket size. In this case use GPO and ADM file below

CLASS MACHINE

CATEGORY !!KERB

KEYNAME „SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters“

POLICY !!MaxToken

VALUENAME „MaxTokenSize“

VALUEON NUMERIC 65535

VALUEOFF NUMERIC 0

END POLICY

END CATEGORY

[strings]

KERB=“Kerberos Maximum Token Size“

You have to create register key over GPO:

Open the Group Policy Management Console (Gpmc.msc).

To do this, click Start, click Run, type gpmsc.msc, and then click OK.
In the Group Policy Management Console, right-click a Group Policy object, and then click Edit to open the Group Policy Management Editor window.
Expand Computer Configuration, expand Preferences, and then expand Windows Settings.
Right-click Registry, point to New, and then click Registry Item. The New Registry Properties dialog box   appears.
In the Action list, click Create.
In the Hive list, click

HKEY_LOCAL_MACHINE.

In the Key path list, clisk SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters.

In the Value name box, type MaxTokenSize.
In the Value type box, click to select the REG_DWORD check box.
In the Value data box, type 65535
Next to Base, click to select the Decimal check box.
Click OK

query disable computers objects

(&(objectCategory=computer)(Name=*)(userAccountControl:1.2.840.113556.1.4.803:=2))

**********************

Windows PowerShell Transcript Start

Start time: 20120313094724

Username  : VDI\amasv

Machine                : DCHV (Microsoft Windows NT 6.1.7600.0)

**********************

Transcript started, output file is C:\Users\amasv\Documents\PowerShell_transcri

pt.20120313094724.txt

PS C:\Windows\system32> Get-ADObject -SearchBase „cn=Deleted Objects,DC=vdi,DC=fujitsu,DC=lab“ -Filter {lastKnownParent -eq „OU=accounts,DC=vdi,DC=fujitsu,DC=lab“} -IncludeDeletedObjects

Deleted           : True

DistinguishedName : CN=martin skapa\0ADEL:704fed33-f62c-4401-9d4b-760748508fb1,

CN=Deleted Objects,DC=vdi,DC=fujitsu,DC=lab

Name              : martin skapa

DEL:704fed33-f62c-4401-9d4b-760748508fb1

ObjectClass       : user

ObjectGUID        : 704fed33-f62c-4401-9d4b-760748508fb1

Deleted           : True

DistinguishedName : CN=martina R.\0ADEL:0295617c-30aa-4ef2-bc19-5191714752

94,CN=Deleted Objects,DC=vdi,DC=fujitsu,DC=lab

Name              : martina R.

DEL:0295617c-30aa-4ef2-bc19-519171475294

ObjectClass       : user

ObjectGUID        : 0295617c-30aa-4ef2-bc19-519171475294

PS C:\Windows\system32> Get-ADObject -SearchBase „cn=Deleted Objects,DC=vdi,DC=fujitsu,DC=lab“ -Filter {lastKnownParent -eq „OU=accounts,DC=vdi,DC=fujitsu,DC=lab“} -IncludeDeletedObjects | Restore-ADObject

or simple command

Get-ADobject -filter {displayName -eq „martin“ } -includeDeletedObjects | Restore-ADObject

PS C:\Windows\system32> Stop-Transcript

**********************

Windows PowerShell Transcript End

End time: 20120313094801

**********************