> krbtgt/REALM.COM@REALM.COM for bob@REALM.COM > krbtgt/REALM.NET@REALM.NET for bob@REALM.NET If we just pretend we have two krbtgt in one ticket cache, which one do you use to derive your service tickets from? If the two realms have cross trust, there are two ways and no way to choose which one. Harald.