Is this something you set on the client it self or on the freeipa server for the host?. I never set such a option for any client though. i did enroll the other clients with the “freeipa-client-install” command and tried fedora with the initial setup. so their might be a difference in it how to enrolls?