Max Token Size, RDS/TS Server and "Access Denied" error message

i have ts/rds win2008r2 members server, windows 7 machines, apps published via webgateway, everithing fine

some users began complain "access denied" message ins ts/rds , noticed problems related users belongs many groups. used simples powershell script (http://gallery.technet.microsoft.com/scriptcenter/check-for-maxtokensize-520e51e5#content) , result was: 

there 377 groups in token.
192 domain global scope security groups.
177 domain local security groups.
0 universal security groups inside of users domain.
0 universal security groups outside of users domain.
there 0 sids in users sidhistory.
current useraccountcontrol value 66048.
token size 9816 , user not trusted delegation.
******************************************
problem not detected.

why problem not detected? why? test mande in win 8.1 machine, using copied/duplicated user , not on win7 user machine. test pass, in win8 machine , maybe fail in users win7 machine?

i have 16 dcs spreaded arrounf company, plus 1 brand new win2012 dc on remote location

if need update software make sure token size enough, i´ll need update members servers? dcs? (all of then?) and/or clinet machines? (http://support.microsoft.com/kb/327825/en-us)

if check event log on machine users access denied messages find entry states token size large , exact size. if it's larger 12000 bytes you'll problems. script may not entirely accurate.

as increasing max token size, @ minimum you'll need increase size on rds server(s), preferably on workstations. see http://blogs.technet.com/b/shanecothran/archive/2010/07/16/maxtokensize-and-kerberos-token-bloat.aspx more information.

Windows Server  >  Directory Services