The Client Authentication Agent requests user authentication from the Kerberos Authentication Server.  When the user is authenticated, the Kerberos Authentication Server returns a Ticket Granting Ticket (TGT) to optimize future activity.