I have confirmation that Windows XP SP2 uses a different location for the magic key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\ AllowTGTSessionKey = 0x1 (DWORD) Setting this value allows the Session key to be retrieved