Set NT-SRV-INST on TGS principal names in get_in_tkt.c:build_in_tkt_name because Windows Server 2008 R2 RODC insists on it. Thanks to Bill Fellows for reporting this problem. http://src.mit.edu/fisheye/changelog/krb5/?cs=24438 Commit By: tlyu Revision: 24438 Changed Files: U trunk/src/lib/krb5/krb/get_in_tkt.c