IE using NTLM instead of Kerberos?

[Jason Fenner]

Hello.

I have installed the Kerberos MIT package and am using mod_auth_kerb to 
authenticate to my apache server via Internet Explorer.  The KDC is a 
Windows 2003, which also acts as our Domain Controller in a Active 
Directory network. 

Below is the log snipet I keep getting when I hit the protected web site 
with Internet Explorer on a XP workstation that is authenticated to the 
domain.

[Fri Feb 17 17:04:01 2006] [debug] src/mod_auth_kerb.c(1322): [client 
10.30.200.24] kerb_authenticate_user entered with user (NULL) and 
auth_type Kerberos
[Fri Feb 17 17:04:01 2006] [debug] src/mod_auth_kerb.c(1322): [client 
10.30.200.24] kerb_authenticate_user entered with user (NULL) and 
auth_type Kerberos
[Fri Feb 17 17:04:01 2006] [debug] src/mod_auth_kerb.c(1023): [client 
10.30.200.24] Acquiring creds for HTTP/rt.vitamix.com at VITAMIX.COM
[Fri Feb 17 17:04:01 2006] [debug] src/mod_auth_kerb.c(1152): [client 
10.30.200.24] Verifying client data using KRB5 GSS-API
[Fri Feb 17 17:04:01 2006] [debug] src/mod_auth_kerb.c(1168): [client 
10.30.200.24] Verification returned code 589824
[Fri Feb 17 17:04:01 2006] [debug] src/mod_auth_kerb.c(1194): [client 
10.30.200.24] Warning: received token seems to be NTLM, which isn't 
supported by the Kerberos module. Check your IE configuration.
[Fri Feb 17 17:04:01 2006] [error] [client 10.30.200.24] 
gss_accept_sec_context() failed: A token was invalid (Token header is 
malformed or corrupt)

I have followed these instruction completely: 
http://www.grolmsnet.de/kerbtut/

The research I have done so far shows that IE will try kerberos first, 
and then fail over to NTLM.  So I assume that my kerberos with MIT's 
package is failing for some reason.  Does any one have any idea on what 
may be causing this?  This SPN and the keytab file all look fine.  I'm 
really stumped.  Any one up for a challenge and want to help me out here?

Thanks in advance!