环境：
AD：Windows Server 2003升级Windows Server 2008 R2
客户端：Windows 7+XP mode
故障：
AD 2003升级到2008 R2（系统升级，其他没变），导致客户端Windows 7内的XP mode登陆域时间过长，在XP Mode重新配置用户配置文件，登陆正常。
在AD上看到日志有Event 40960和40961的警告：
Event ID: 40960
Source: LsaSrv
Type: Warning
Category: SPNEGO (Negotiator)
Description: The Security System detected an attempted downgrade attack for server <server name>. The failure code from authentication protocol Kerberos was "There are currently no logon servers available to service the logon request. (0xc000005e)".
Event ID: 40691
Type: Warning
Source: LSASRV
Category: SPNEGO (Negotiator)
Description:
The Security System could not establish a secured connection with the server ldap/xxxx.com. No authentication protocol was available.
解决方法：
在XP mode用本地管理员登陆，打开注册表，在[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Parameters]
添加DWORD，DWORD名字为MaxPacketSize，值为1
本文出自 “gs_hao” 博客，谢绝转载！
[case分享]AD 2003升级2008导致XP mode登陆域时间长
原文：http://gshao.blog.51cto.com/3512873/1763137