Odd Kerberos issue

very simple: 10.3 client bound to AD w/ built-in plugin :) log into domain OK :) get kerberos TGT :) try to connect to server... get username/password/domain dialogue?! :( this isn't supposed to happen. Where's my single sign-on? Why am I not getting a session ticket back from the AD KDC when I do log into the server? ARGH!