Not sure if this can be classified as a bug, however it is very
scripting hostile when building config templates for webfilter profiles.
I personally would like to see this behavior changed so that CLI created
profiles have a blank table, or at least...
I'd recommend getting a packet capture on the client and enable Kerberos
error logging. Double check the relevant browser auth settings (firefox
splits ntlm and spnego/kerberos settings) and/or GPO. Also ensure your
client has visibility to the KDC, ...
