It used to be the case that the MSLSA cache would work reasonably well without TGT keys available. Namely, if you retrieved a ticket the cache would ask the LSA to get the ticket for you,. Does this no longer work? If this does work, does it meet your needs? If not, what functionality are you missing?