Is there any reason I wouldn't want +requires_preauth on any user accounts? It looks like it doubles the number of connections to the KDC to get the tgt, but besides that additional load, is there any downside to doing it? Thanks, Chris