The System.Security.Authentication.ExtendedProtection.ExtendedProtectionPolicy is always enforced. Clients that don’t support extended protection will fail to authenticate.