Users in trusted partner forest intermittently failing to authenticate against resources

John Doe 20 Reputation points
2026-07-15T17:23:56.15+00:00

Hello, Im having issues with users in a trusted partner forest intermittently failing to authenticate against our resources and the system doesnt seem to let them through consistently. Those users we have intermittent connection issues with. Ive already spoken to my administrator who tried everything she could. But its definitely either SID filtering, name suffix routing, or selective authentication misconfiguration that needs to be checked. Please help.

Windows for business | Windows Server | Directory services | User logon and profiles
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Tracy Le 11,615 Reputation points Independent Advisor
    2026-07-15T18:15:04.82+00:00

    Hi John Doe,

    When you get intermittent auth issues over a forest trust, it usually boils down to selective authentication misconfigurations or Kerberos packet fragmentation. If selective auth is turned on, make sure the users or their groups from the trusted forest actually have the Allowed to Authenticate permission on the target resource's computer object. Also, check the Name Suffix Routing tab under the trust's properties in Active Directory Domains and Trusts to ensure their UPN suffix is active and not excluded.

    Since the failure is intermittent, there is a big chance your Kerberos tickets are hitting the MTU limit and getting fragmented over UDP. You can easily force Kerberos to use TCP instead by adding a MaxPacketSize DWORD registry key set to 1 under HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters on the resource servers. Run nltest /sc_query to check the secure channel health too. If this does the trick, please accept the answer to help others out!

    Tracy Le.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.