The key for non-Server versions of Windows is HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos AllowTGTSessionKey = 0x1 (DWORD) This is set by the KFW installers. Although we are not currently setting the MSLSA as the default cache I am going to close this ticket at this point because significant progress has been made to improve the interoperability of the LSA cache. See ticket 2705.