I'd have to have a member of the Kerberos team answer this question, but I'd say two things: Check out the Kerberos protocol docs on MSDN, and consider that to do this, you'd effectively be creating a man-in-the-middle downgrade attack intentionally in your own environment. What's to prevent an attacker with an internal foothold from leveraging this to own the rest of your environment? You'd be opening the environment to tons of liability.