If you have central applications what I'd suggest doing is getting both 3des and des session key tickets at the same timewhen a new client kinits. I'd also consider moving towards shared libraries for krb5.