Which authentication protocols to use, and in which order.
Negotiate prefers Kerberos and will use it unless it is unavailable; it then will use NTLM.
Kerberos will always be unavailable if the system is not connected to a domain, or is configured incorrectly.
NTLM is an additional option that will allow setting a preference for NTLM,
or to prevent errors in case of Kerberos misconfiguration.