I fixed an issue yesterday where a 2008 R2 machine did not want to communicate with the DC. I discovered warnings in the event log relating to the kerberos buffer, so I increased the size in the registry and rebooted the server, voila, issue resolved. The issue was, I was unable to open ADUC from the 2008 R2 machine (which is NOT a DC) and got access denied messages.
However, now I am thinking for the future. I know the buffer size was increased to 48k for 2012, but how does that translate in regards to the max groups users can be a member of?
I would like to plan ahead and not have this issue happen again, so this is why I ask.
In my AD, I have a LOT of groups, and there are many group nestings as well. I have read something about using LDAP so you don't kill your AD with huge queries. Can someone please elaborate on this as well?