Before using a specific security package, both client and server should call the EnumerateSecurityPackages function to enumerate the security packages that are available from the security provider. The EnumerateSecurityPackages function returns an array of SecPkgInfo structures that describe the attributes of the available security packages. A client or server can also use the QuerySecurityPackageInfo function to determine the attributes of the specified security package.
After selecting one or more security packages from those available, a server waits for a client to connect. When a client starts up, it also selects from the available security packages based on what it expects for the transaction with the server.