The Windows Kerberos LSA will by default on the next generation of service packs not export session keys for TGTs, only service tickets. In this circumstance, the MSLSA ccache should not output the ticket if there is a NULL enctype set.