How to ensure machine is “Kerberos Domain” joined?

Question

i've been having issues where calls to the LogonUser Windows API function is falling back to NTLM authentication, rather than using the preferred, default, Kerberos authentication.

Researching the problem, a guy has a suggestion:

The thing to do is to figure out why the code is using NTLM instead of Kerberos in the first place since Kerberos is the default and to try to see if it can be changed to make it use Kerberos. A couple of things come to mind:

• The client machine must be domain joined to use Kerberos

Now i've never heard of being domain joined to use Kerberos. Either you're joined to an Active Directory domain, or not, right?

In this case the machine is joined to an Active Directory domain, e.g.:

contoso.local

What does it mean to be "domain joined to use Kerberos"; and how do i ensure that my machine is?

Answer 1

Whenever I've heard or used the term "domain joined" it has meant "The state of being joined to an Active Directory domain".

Answer 2

It took a sleep to understand @TheCleaner and @HarryJohnston 's comments.

The original author's point was so blindingly obvious that my brain was looking for the real meaning.

Kerberos authentication only works in an Active Directory domain (henceforth referred to as a domain).

Machine Joined to        Logon Types available
=====================    ================================
Workgroup                NTLM
Windows NT 4 domain      NTLM
Active Directory domain  Kerberos (with fallback to NTLM)

The only way you can even hope to use Kerberos is if you are joined to an Active Directory domain.

Which i would have thought is so fundamental that it's not even in question.

But there's the advice.

Answer 3

To see if a machine is using kerberos authentication you can use "Kerberos Tray" and klist and take a look if you can see a KTG (kerberos ticket granting ticket). If you see this, that means that you are "joined" to a kerberos domain.

Kerberos Tray and Kerberos List klist are included in the Windows Server 2003 Resource Kit and the Windows 2000 Resource Kit.

See also: http://technet.microsoft.com/en-us/library/cc738673%28v=ws.10%29.aspx