Consider the following scenario:

• On a Windows Vista-based computer, you log on to a domain.
• You use a smart card certificate to establish a remote access connection.
• You try to connect the Windows Vista-based computer to a shared resource in a foreign domain by using the remote access connection.

In this scenario, Kerberos authentication that uses the Public Key Initialization (PKINIT) protocol in the foreign domain fails. For example, when you use the net use \\ComputerName\ShareName command to connect the computer to a shared resource in the foreign domain, you cannot make the connection.

Note: PKINIT is an Internet Engineering Task Force (IETF) Internet Draft for “Public Key Cryptography for Initial Authentication in Kerberos.” Windows Vista uses the PKINIT protocol when you use a smart card to perform an interactive logon.