...Users] Group Membership Support · Issue #5258 · FreeRDP/...
and only gets access to a tgt on behalf on the host on which it runs, in such case a regular ap-req won't do since the service can't decrypt tickets (encrypted with the long term key), so the client ask the tgt from the service, then ...