We have to create krb5.ini on Windows to show what Kerberos realm and KDC should be used. In fact, on Windows, if the logon user is already a Windows AD account, two environment variables -- USERDNSDOMAIN, LOGONSERVER -- are created by the system for these 2 properties. We should use them when krb5.ini is missing.

These environment variables have been set since Windows 2000.