Hi Andrew Want to confirm something with you: There are some kinds of Kerberos tickets inside the LSA cache that you can never get the encoded form, right? I've seen a ticket in kerbtray.exe that's flagged FORWARDED, but never find out how to get its encoded form, therefore cannot use it in Java. Thanks Max