[OpenAFS] Unable to prevent KAS from granting tickets to WIndows-Client

[Russ Allbery]

Derrick J Brashear <shadow@dementia.org> writes:

> It's been a while, but you should be able to use expires NOW and expires
> NEVER to lock and unlock accounts; I think this was set with kas setf but
> I don't remember for sure.

> NOTGS was probably never implemented for krb4 (as opposed to ka)

NOTGS in the kaserver works correctly with MIT kinit -4.  We've been using
it for years to lock accounts.  (Maybe I'm misunderstanding?)

-- 
Russ Allbery (rra@stanford.edu)             <http://www.eyrie.org/~eagle/>