0

Since Windows 10 we have a problem with Windows-based clients in our FreeIPA linux domain.

We use ksetup to allow authentication over Kerberos so that, after setting up local accounts, users can use the same password as on Linux. This worked reasonably well up to Windows 8.1.

After upgrading to Windows 10, the computer becomes extremely slow when logging in over Kerberos. The login takes up to 30 minutes, opening the Start menu takes about 1-2 minutes and opening applications like Firefox also takes about 5 minutes, which makes the computers effectively unusable.

When logged into a local user account everything is fast as expected, even when accessing Samba shares or other resources in the network.

What may be a cause for this behaviour?

Improve this question
7
  • Is there any unusual network traffic while an app is trying to start?
    – user1686
    Jun 3, 2019 at 12:58
  • @grawity While logged in there are Net Bios Name Service Requests every second for a Domain Master Browser. The requested name seems to be the leftmost part of our Kerberos domain name
    – cg909
    Jun 3, 2019 at 13:43
  • Some specific versions (FreeIPA) might be helpful.
    – Ramhound
    Jun 3, 2019 at 15:15
  • @Ramhound It's FreeIPA 4.4.4 with krb5-server 1.14.4.
    – cg909
    Jun 3, 2019 at 16:23
  • @cg909 - How recent are those versions? Looking at the FreeIPA website it appears 4.4.x is not being maintained, I am guessing upgrading to 4.6.x+ isn't possible? Does this behavior happen on any machine added to the domain or just the machines that were upgraded? Are there any hints within the logs? Seems strange that opening a local executable would require communication with the IPA server. Any helpful important information should be contained in the question instead of comments.
    – Ramhound
    Jun 3, 2019 at 16:26

1 Answer 1

Reset to default
0

The cause was “NetBIOS over TCP/IP” (thanks to @grawity for the clue to look at the network traffic).

Windows 10 seems to constantly look for a Domain Master Browser over NetBIOS when logged in with a Kerberos/domain user. This causes the extreme slowdowns (probably every time user information like group memberships are needed) if no Windows domain exists in the network.

So completely disabling “NetBIOS over TCP/IP” on every Windows 10 client by opening the network adapter details → “Properties” → “Internet Protocol Version 4 (TCP/IPv4)” → “Properties” → “Advanced…” → “WINS” → “Disable NetBIOS over TCP/IP” solved the issue.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.