It's weird that the 'admin' IPA user worked until I changed the password. I'm working on getting a WinXP system to test with now. <div class="gmail_quote">On Mon, Sep 19, 2011 at 1:32 PM, Simo Sorce <<a href="mailto:simo@redhat.com">simo@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im">On Mon, 2011-09-19 at 13:05 -0400, Jimmy wrote: > Once I changed the password for 'admin' I now get this error on the > windows system: > > > > Insufficient system resources exist to complete the requested service > > > and get this in the log no matter if I use the correct(changed) > password or if I use a known bad password: > Sep 19 17:01:19 csp-idm.pdh.csp krb5kdc[1246](info): AS_REQ (7 etypes > {18 17 23 3 1 24 -135}) <a href="http://192.168.201.9" target="_blank">192.168.201.9</a>: NEEDED_PREAUTH: admin@PDH.CSP > for krbtgt/PDH.CSP@PDH.CSP, Additional pre-authentication required > > > I even deleted the user and all associated profile information on the > windows system and still it won't work any more. > > </div>Ok somehow we generate a key the windows client doesn't like or know how to work with. While MIT's clients are just fine with. The way we generate keys is by setting a special random seed that is handed back to the client when the preauth error is generated, perhaps Windows is not liking what it sees ? Any chance you can try with an older client, I wonder if it is a regression in win7 ? <div><div class="h5"> Simo. -- Simo Sorce * Red Hat, Inc * New York </div></div></blockquote></div>