On 04/10/2010 07:48, "guest01" <guest01@xxxxxxxxx> wrote: >got NTLMSSP command 3, expected 1 As you say isn't that because a Kerberos client is trying to send auth and thus not capable of NTLM? Can you track it down to the requesting machine(s) and client? It's like my Mac Safaris can only use NTLM and not Kerberos, only reverse.. I use both helpers. Kerberos auth ordered first and then NTLM second in squid conf. N > The information contained in this e-mail is of a confidential nature and is intended only for the addressee. If you are not the intended addressee, any disclosure, copying or distribution by you is prohibited and may be unlawful. Disclosure to any party other than the addressee, whether inadvertent or otherwise, is not intended to waive privilege or confidentiality. Internet communications are not secure and therefore Conde Nast does not accept legal responsibility for the contents of this message. Any views or opinions expressed are those of the author. The Conde Nast Publications Ltd (No. 226900), Vogue House, Hanover Square, London W1S 1JU