Manually Adding the Registry Key
MKS Domain groups contain users from the MKS Domain.
1. Change the mks.security.allowClientRegistryEdit property to false in the security.properties file on the server (if you leave this property set to true, the keys are added automatically).
2. Add the key:
HKEY_LOCAL_MACHINE/System/CurrentControlSet/Control/Lsa/Kerberos/Parameters
Value Name: allowtgtsessionkey
Value Type: REG_DWORD
Value: 0x01 (default is 0)
In cases where the Windchill RV&S client needs to automatically create the registry key, you may still be prompted for a password for the very first connection from the client to the server, even if the server is configured for Kerberos SSO. You may need to reboot the client machine before the new registry key takes effect.