Kerberos "Max Logon Attempts" Meaning

When adding the "Kerberos" Auth Item to an APM Policy what affect does the "Max Logon Attempts" have. What actually happens here, does it send another 401 to the client to get another kerb token?

Is there a best practice here? default I think is 3 but allows 1 to 5

Cheers