Hi, Thank you for the information, I have tried all these steps, but no success 1. On the IPA Server I have created a host principal using the following command. # kadmin -q "ank host/<a href="http://bmdata01.testing.com">bmdata01.testing.com</a>" 2. On the windows xp client C:> ksetup /setrealm <a href="http://TESTING.COM">TESTING.COM</a> C:> ksetup /addkdc <a href="http://TESTING.COM">TESTING.COM</a> <a href="http://viji.bigmaps.com">viji.bigmaps.com</a> C:> ksetup /setmachpassword <password> C:> ksetup /mapuser <a href="mailto:admin@TESTING.COM">admin@TESTING.COM</a> guest C:> ksetup /mapuser * * After the above setup windows is showing <a href="http://TESTING.COM">TESTING.COM</a> as a Kerberos Realm on the login screen, but when I try to login using the user name "admin" it is throwing the following error. "The system could not log you on. Make sure your user name and domain are correct, and then type your password again. Letters in passwords must be typed using the correct case." But the IPA (kerberos) server is issuing the tickets, the log shows: Dec 30 22:36:03 <a href="http://viji.testing.com">viji.testing.com</a> krb5kdc[5179](info): AS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) <a href="http://172.16.33.112">172.16.33.112</a>: NEEDED_PREAUTH: <a href="mailto:admin@TESTING.COM">admin@TESTING.COM</a> for krbtgt/<a href="http://TESTING.COM">TESTING.COM</a>@<a href="http://TESTING.COM">TESTING.COM</a>, Additional pre-authentication required Dec 30 22:36:03 <a href="http://viji.testing.com">viji.testing.com</a> krb5kdc[5179](info): AS_REQ (3 etypes {23 3 1}) <a href="http://172.16.33.112">172.16.33.112</a>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM">admin@TESTING.COM</a> for krbtgt/<a href="http://TESTING.COM">TESTING.COM</a>@<a href="http://TESTING.COM">TESTING.COM</a> Dec 30 22:36:03 <a href="http://viji.testing.com">viji.testing.com</a> krb5kdc[5179](info): TGS_REQ (7 etypes {23 -133 -128 3 1 24 -135}) <a href="http://172.16.33.112">172.16.33.112</a>: ISSUE: authtime 1230656763, etypes {rep=23 tkt=18 ses=23}, <a href="mailto:admin@TESTING.COM">admin@TESTING.COM</a> for host/<a href="http://bmdata01.testing.com">bmdata01.testing.com</a>@<a href="http://TESTING.COM">TESTING.COM</a> I have found some article on Microsoft website, saying this is a bug and apply the latest service pack (SP3), I even tried that, but no success. <a href="http://support.microsoft.com/kb/825081">http://support.microsoft.com/kb/825081</a> Similar Thread: <a href="http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html">http://mailman.mit.edu/pipermail/kerberos/2006-May/009890.html</a> Thanks & Regards Viji <div class="gmail_quote"> On Mon, Dec 29, 2008 at 6:35 PM, Konstantin Kozlov <<a href="mailto:kozlov@spbcas.ru">kozlov@spbcas.ru</a>> wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"> Hi, You can search the list for a similar thread and here are the steps I've followed with success: Add host principal for winxp machine with the encoding des-cbc-crc and passowrd (-P ioption for ipa-getkeytab). Do not store this keytab in /etc/krb5.keytab but rather in some other file. Install MS Support Tools on WinXP, and run ksetup /setdomain ... ksetup /addkdc ... ksetup /setcomputerpassword ... ksetup /mapuser * <your user> WinXP machine asks to login to Kerberos realm at login screen. I failed to map one ipa-user to one win-user. But may be because I didn't have enough time. If you will succeed - leave a note here please. Best regards, Kostya Viji V Nair wrote: <blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><div><div></div><div class="Wj3C7c"> Hi, I am a new user of free-ipa, I have installed the free-ipa packages shipped with fedora 10. I have more that 100 windows clients to authenticate. Here is my problem, All the clients are XP SP2, I have installed MIT Kerberos for Windows 3.2.2. Always the native windows login prompt appears first, when i login to windows the kerberos client is asking for authentication. I want to replace this windows authentication with kerberos Any help on the same will be greatly appreciated. Thanks Viji </div></div> ------------------------------------------------------------------------ _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </blockquote> -- Konstantin Kozlov Department of Computational Biology, Center for Advanced Studies, SPb State Polytechnical University, 195251, Polytechnicheskaya ul., 29, bld 4, office 204, St.Petersburg, Russia. Tel./fax: +7 812 596 2831 _______________________________________________ Freeipa-users mailing list <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a> </blockquote></div>