Every server runs a local KDC backed by the local SAM, so when you authenticate to a server in workgroup mode you'll be using Kerberos over IAKERB to do an AS e

Every server runs a local KDC backed by the local SAM, so when you authenticate to a server in workgroup mode you'll be using Kerberos over IAKERB to do an AS exchange (think `kinit`) followed by the AP exchange. So you still get standalone username & password authentication.