>Cool ! Thanks - that looks like it - you can't kinit for the fqdn >host and cifs principals, but you can get them with kvno. Thanks >for the help, I'll store that away for future testing.... :-). Actually, you may be able to kinit for the "fqdn" principals if you modify kinit to set the name canonicalize bit in the AS-REQ. -- Luke