I'm looking to set up a Kerberos trust between MIT Kerberos5 and Active Directory. However, it's noted in my old Kerberos book from 2003 that "there are several applications, notably Microsoft Exchange (2000 and below), that still use the older NTLM-style authentication."
Fortunately, we don't use MS Exchange, but there's concern that we may miss an important use case that Kerberos doesn't support. I know other organizations in our industry have done a similar setup, and I know they have found workarounds for this, but I haven't found a good list of apps that gave them problems. Can the ServerFault community help me out here? Even anecdotal evidence is appreciated.
EDIT 1: APIs to Active Directory require password changes to be delivered in plaintext rather than hashes. We'd like to remove that requirement from our authentication infrastructure by standing up an MIT realm for user authentication. There are some use cases that might make helpdesk's life easier, but it would be difficult to get other people in IT to agree to a change if it breaks any applications.