Chad,

   thanks for the article, I as well have seen this error and everytime I try to research it all I find are documents from the perspective of Kerbos in general, or from the point of view of a Network administrator (which I am not).  You elluded to part of the answer in your article and I have re-printed the quote below

"(see KLIST and KERBTRAY.EXE Windows 2000 Resource Kit utilities to view current tickets). "

My question is how do I know if a connection is comming in as kerbos or is demoting to NTLM.  What was your perspective on using Klist or the KerbTray.exe applications to view Kerbos connections.  How did you view NTLM conections? From this where there any tricks learned?  Ofcourse I'm off to try myself, but I thought I would bring it up as a possible add in to the next revision of this Doc (if any).  Ideally I would like to know how to check each of the three types of connections so that I might know definitely how my connection are occuring to the database.

The 3 types

1. NTLM over Named Pipes (not using SSPI)

2. NTLM over TCP-IP sockets via SSPI

3. Kerberos over TCP-IP sockets via SSPI

Thanks,

Mudluck