Windows – Is it possible to switch to Kerberos only Windows domain

This seemed familiar and Google searching brought me back to ServerFault. Long story short, Micros*** extends Kerberos in a way that makes client authentication with alternative Kerberos implementations (e.g. MIT or Heimdal) not easily accomplished. This is why projects like pGina were created. That might be primarily for LDAP auth, but the cause will lead to you needing a similar result, namely coding your own custom GINA DLL to handle that kind of auth. If you find one that handles Kerberos, please let us know! I would be super-excited to use it and find out.

It appears that a key difference is that in the test environment the CNAME is registered in the same domain as the A record (e.g. host.example.com is the A record and alias.example.com is the CNAME).

In the production environment, the CNAME is for a domain that used to be used, but is no longer the preferred domain, which is where the A record is (e.g. prodhost.example.com is the A record and prodalias.example.net is the CNAME).

Supposedly, the example.net DNS zone (along with the example.com DNS zone) is tied to the example.com domain in Active Directory, but we haven't been able to confirm this configuration yet. Certainly Internet Explorer doesn't seem to be believe that they are related, which is why it's not even attempting to do the Kerberos authentication.

Anyone have pointers / thoughts on this?