- 1 minutes to read

PACVerification

This article is intended to provide ways to improve performance for communication where the Kerberos protocol is being used.

Most Nodinite products can benefit from Disabling PAC verification. Actually, all services like BizTalk Server, SQL Server and so on may get slightly better performance.

One can argue that doing so may compromise security, however, we are under the impression that changing this value only boost the performance, it does not fix or make your Windows more or less secure.

Please review the following articles to get your attention on this matter:

Beginning with Windows Server 2003 SP2, you can turn off PAC verification for services. To do this, add the ValidateKdcPacSignature registry entry to the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters

ValidateKdcPacSignature DWORD Description Comment
0 Disabled Default for Windows 2008
1 Enabled Default for other OS Versions

You must restart the Windows Server if you change this value

Changing registry values is always risky, and you must ALWAYS comply with the policies that exists within your organization.

CHANGE AT YOUR OWN RISK