                                                                     
                                                                     
                                                                     
                                             
--- a/kdc/kerberos5.c
+++ b/kdc/kerberos5.c
@@ -91,7 +91,8 @@
 _kdc_is_weak_exception(krb5_principal principal, krb5_enctype etype)
 {
     if (principal->name.name_string.len > 0 &&
-	strcmp(principal->name.name_string.val[0], "afs") == 0 &&
+	(strcmp(principal->name.name_string.val[0], "afs") == 0
+	 || strcmp(principal->name.name_string.val[0], "nfs") == 0) &&
 	(etype == ETYPE_DES_CBC_CRC
 	 || etype == ETYPE_DES_CBC_MD4
 	 || etype == ETYPE_DES_CBC_MD5))
