I still need to examine the trace in detail, but did you notice whether there was a ticket request processed by the KDC in both cases? ---Tom