macOS Ventura ActiveDirectory no Kerberos ticket (TGT) gets saved/cached on login (lockscreen does!)

We noticed that on devices running Ventura that are bound to our ActiveDirectory no (valid) kerberos ticket (tgt) / cache is available on login. Previous versions did this without a problem as long as a connection to the AD is available. (Please no comment about SSO or NoMAD)

Now our shares wont connect on login and 'klist' returns 'cache not found'. Funnily - in contrast when entering the password in the lockscreen the ticket does get cached and everything works as expected.

After I remembered an older bug on Mojave regarding Kerberos with /etc/pam.d/authorization and /screensaver I looked in these files and found that 'authorization' had a very suspicious option (and screensaver didn't):

no_ccache

I compared it against another device still running Monterey and it didn't have it...

So I tried removing it, rebooted and who would have thought? It now does create the correct Kerberos cache with the TGT in it as it should be!

But of course I have no Idea what side effects removing that options has especially regarding security. Also updating to a newer build resets this config...

Does anyone have more insights into this? Maybe it is a known issue I just couldn't find anywhere?