I have succesfully configured an external kerberos realm on Windows Server 2008 R2, using manual method. On WS2008: $ ksetup /SetRealm MY.REALM.EXAMPLE $ ksetup /AddKDC MY.REALM.EXAMPLE kdc.my.realm.example $ ksetup /SetRealmFlags MY.REALM.EXAMPLE delegate $ ksetup /mapuser user@MY.REALM.EXAMPLE user The problem is with the default proposed domain on the logon screen: it is "MY" (and not "MY.REALM.EXAMPLE"). I sucessfully logon using "MY.REALM.EXAMPLE\user" with the kerberos password, but when I use "user", it try to log as "MY\user" (and error). How to configure the default domain ? The KDC is heimdal (netbsd). The WORKGROUP is "MY.REALM.EXAMPLE" (automatically configured by ksetup /setrealm), but as the logon screen, when I use the ServerManager, on the detail of the server, the workgroup is "MY". When I use the form for change the workgroup, it is "MY.REALM.EXAMPLE"...