title: What can cause a Kerberos TGT session key on Windows to be all zeros
body: <p>I recently asked a question about some problems I was having getting MIT Kerberos to work nicely with Microsoft's LSA credentials cache.</p>
  
  <p>I was told that setting the registry key <code>AllowTGTSessionKey</code> should fix the problem.</p>
  
  <p>However, I'm still having problems, and now I dug a bit deeper.</p>
  
  <p>Running <code>klist tgt</code> (using the klist provided by Microsoft in <code>\windows\system32</code>), it shows, among all the other output, this:</p>
  
  <pre><code>Session Key        : KeyType 0x17 - RSADSI RC4-HMAC(NT)
                     : KeyLength 16 - 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  </code></pre>
  
  <p>So, the session key is <em>still</em> blanked out, even though that was the problem the registry key mentioned above was supposed to solve.</p>
  
  <p>So which <em>other</em> conditions might lead to the session key being blanked out?</p>
  
  <p>I've tried with all sorts of user accounts now (domain admins, domain users, with and without UAC enabled), and nothing seems to make a difference.</p>
  
  <p>So, does anyone know what the problem might be? Or know of a solution (and/or ugly hacky workaround)</p>