I have a few problems with the existing kerberos_verify code. I noticed that a w2k server uses HOST/fqdn instead of host/fqdn which is not one of the allowed principal names. Also I need a setup where I can use DNS CNAMES or aliases, so I think you should read the keytab and try any cifs/CIFS host/HOST in it. Thanks Markus