>I believe if you disable the use of preauthentication for your Win2K >user principals, the PAC data is not included in their tickets. Or your client can send a KERB-PA-PAC-REQUEST with include-pac set to FALSE. -- Luke -- Luke Howard | PADL Software Pty Ltd | www.padl.com