WinRM Quickconfig / Enable-PSRemoting Issues with Large Kerberos Tokens

Symptoms

• WSManFault Message = The WinRM client received an HTTP bad request status (400), but the remote service did not include any other information about the cause of the failure. Error number: -2144108175 0x80338171. The WinRM client received an HTTP bad request status (400), but the remote service did not include any other information about the cause of the failure.

• WSManFault Message = The WinRM client cannot process the request. It cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalid.  Error number: -2144108297 0x803380F7  The WinRM client cannot process the request. It cannot determine the content type of the HTTP response from the destination computer. The content type is absent or invalid.

How to solve the issue

In some environments, the user may be a member of so many security groups that the Kerberos token size used to authenticate the user is greater than 16KB. This will cause the HTTP or WinRM server to reject the request with a message similar to the above, depending of the version of WinRM.

There are a couple of ways we can get around this:

• use another administrator account that is a member of fewer groups,
• reduce the number of groups the current user is a member,
• increase the maximum allowed size of the Kerberos token.

For more information on how to increase the size of the Kerberos token, please refer to this article: http://support.microsoft.com/kb/820129

Microsoft Related Links

• Large Kerberos tokens cause WinRM requests to fail
• About Windows Remote Management