pypsrp defaults to auth='negotiate', which attempts Kerberos with no domain and fails under SSPI with SEC_E_UNKNOWN_CREDENTIALS for the workgroup ci_build account. Default to 'ntlm' (configurable). The guest username must be host-qualified (WINBUILD-2025\ci_build) and stored that way in the credential vault.