AD Login Issues TCP/135

[Mike L.]

I have several users dialing in to a metropolitan area
network using Windows 2000 Professional. The routers
between me and them have an ACL blocking TCP/135 due to
propagation of the latest worms, etc.

ISSUE: Logins to Active Directory are taking upwards of
20-minutes to complete. Login scripts eventually fire,
but the latency is incredible. I have a fundamental
understanding of RPC, but have no idea how to work around
the issue. I do have a packet capture of a logon session
and it repeatedly tries to contact the DC on tcp/135 for
about 15 minutes before using other avenues. Are there
any registry settings or other configuration paramaters
that can help alleviate this problem?

TIA,

-ML

 

[stevta [MSFT]]

Force kerberos to use TCP instead of UDP.

There is a maxpacketsize setting to force this.