Ok I have a problem and I am not sure how I can go about resolving it. This environment utilizes a strange configuration I have not seen anywhere else. Kerberos Realm is: REALM.COM SMB.CONF realm = REALM.COM %> net ads join Failed: no servers If I change it to this: SMB.CONF realm = SUB.REALM.COM %> net ads join 'machine' added to 'SUB.REALM.COM' My problem is not this but I suspect it to be part of the problem. You see I can see all users, all groups within the domain but when I try to authentication one of these users against the SUB.REALM.COM domain it fails. Part of the problem here is that our AD setup does not contain valid password hashes so any NTLM authentication fails. Is there a way to have this ADS server type a member of the SUB.REALM.COM domain but explicitly authenticate all users to REALM.COM (Kerberos Realm). Thanks in advance. -- Jas