Negotiate stream fails NTLM auth

For a .NET 8 App to .NET windows service there is a negotiate auth scheme used to establish the connection. Both apps are running under accounts within the same domain. The host environment for this domain eventually will not support NTLM. I want to enable this for kerberos but the connection always fallsback to NTLM and fails. Noting the steps taken and the code snippet below.

I've set SPN for both accounts using setspn -S TestService/<Hostname> <Domain><username>. The client app uses impersonation to connect to the service.

The windows service hosts a background service that listens for connections

using HttpListener _httpListner = new HttpListener();

_httpListner.Prefixes.Add("http://192.2.0.1:9197/");

_httpListner.AuthenticationSchemes = AuthenticationSchemes.Negotiate;

_httpListner.Start();

On the client, the connection uses impersonation

var handler = new HttpClientHandler

{

UseDefaultCredentials = true,

PreAuthenticate = true
```};

 var client = new HttpClient(handler);

 var response = await client.GetAsync(service);

response.EnsureSuccessStatusCode();

This is on a test machine with no firewall rules or any other policy settings. What could be missing or how do I troubleshoot this? I tried auditing the NTLM attempts and can see the NTLM attempt made if the client is on a different host