The PAC and Its Signatures
What the PAC says about an account, which keys sign it, and who checks each signature.
Why It Matters
Servers grant access from the PAC instead of asking the directory, so whoever can sign a PAC decides who an account is and which groups it holds. Its signatures explain why golden tickets need the krbtgt key and why silver tickets still work.
What Happens
The Privilege Attribute Certificate (PAC) rides in a ticket's authorisation data and carries the account's SID, its group SIDs, logon details and, in a TGT since 2021, the SID of the account that asked for it. The DC builds it at sign-in, seals it into the TGT and copies it into service tickets. Servers build the access token from it without asking the directory.
A TGT's PAC carries two signatures, the server and KDC signatures, both made with the krbtgt key. A service ticket's PAC carries four, the server signature made with the service's own key and the KDC, ticket and extended KDC signatures made with the krbtgt key. The service can check only the first, and only a DC can check the rest.
A server can ask a DC to check the KDC signature over Netlogon (PAC validation), but Windows does so only for services that do not run as part of the operating system. So whoever holds the key of a service that does not ask can forge a PAC it will believe, and whoever holds the krbtgt key can forge, or open and seal again, any PAC at all.
The fixes in the table below let a DC catch a ticket or PAC that anyone without the krbtgt key has altered or misused. They do nothing against a forger who holds that key, which is why the krbtgt password is reset twice after a domain compromise.
The Fixes That Hardened the PAC
Four updates added checks to the PAC and to how it is validated. Each row names the update, what it added and when domain controllers began to enforce it.
| Update | What It Added | Enforced |
|---|---|---|
| KB4598347 (CVE-2020-17049) | The ticket signature, over the ticket itself, so a service using constrained delegation cannot alter a ticket to make it valid for delegation | July 2021 |
| KB5008380 (CVE-2021-42287) | The PAC requestor and attributes, so a DC refuses a TGT whose requestor does not match the account it names, or a ticket with no PAC | October 2022 |
| KB5020805 (CVE-2022-37967) | The extended KDC signature, over the whole PAC in service tickets | From July 2023, with audit mode removed in October 2023 |
| KB5037754 (CVE-2024-26248, CVE-2024-29056) | PAC validation through a new Netlogon request, so a process can no longer spoof the signature check, and stricter filtering across forest trusts | From January 2025, with compatibility mode removed in April 2025 |
What Is Logged
Each event below names the log it is written to, the machine that writes it and the audit setting that switches it on, then what to read in it for this page.
| Event and Log | Written On | Switch It On | What It Tells You |
|---|---|---|---|
| 35 to 38 PAC without attributes, Ticket without a PAC, Ticket without Requestor, Requestor Mismatch (opens in a new tab) System log | Domain controllers | Domain controllers with the November 2021 or later updates (KB5008380) | It flags a TGT with no PAC, no PAC attributes or no requestor, or a requestor that does not match the account it names. |
| 43 and 44 Full PAC Signature Failed, Full PAC Signature Missing (opens in a new tab) System log | Domain controllers | Domain controllers with the November 2022 or later updates (KB5020805) | It flags a service ticket whose full PAC signature failed or is missing. |
| 4627 Group membership information (opens in a new tab) Security log | The computer that was logged on to, beside its 4624 | Audit Group Membership, with Audit Logon success on as well | It lists the groups the server took from the PAC. Groups the account does not hold in the directory point at a forged or altered PAC. |
Check It on a Machine
These Windows Registry keys hold the settings this page names. Open one to see where it lives and how to read it on a machine.
Attacks That Hook in Here
These attacks work through what this page describes. Each card says what the attack is and, where it uses one of these steps, what it does there.
- Silver Ticket
Forges a service ticket with the service's own key, so no DC ever issues it.
- Golden Ticket
Forges a TGT with the krbtgt key, for any account and groups, that every DC accepts.
- Diamond and Sapphire Tickets
Alters a real TGT with the krbtgt key, so a genuine sign-in sits behind the forgery.
- Kerberos Delegation Abuse
Uses a server trusted for delegation to reach other services in users' names.
- noPac (sAMAccountName Spoofing)
A renamed computer account makes a ticket name a privileged account.
Sources
- [MS-PAC] 1.3 Overview (opens in a new tab)
- [MS-PAC] 2.5 KERB_VALIDATION_INFO (User and Group SIDs) (opens in a new tab)
- [MS-PAC] 2.8.2 Ticket Signature (opens in a new tab)
- [MS-PAC] 2.8.3 Extended KDC Signature (opens in a new tab)
- [MS-PAC] 2.8.4 Server Signature (opens in a new tab)
- [MS-PAC] 2.8.5 KDC Signature (opens in a new tab)
- [MS-PAC] 2.15 PAC_REQUESTOR_SID (opens in a new tab)
- [MS-APDS] 1.4.2 Kerberos PAC Validation (opens in a new tab)
- Microsoft Learn: Understanding Microsoft Kerberos PAC Validation (opens in a new tab)
- Microsoft Support KB4598347: Kerberos S4U Changes for CVE-2020-17049 (opens in a new tab)
- Microsoft Support KB5008380: PAC Requestor (CVE-2021-42287) (opens in a new tab)
- Microsoft Support KB5020805: Full PAC Signature (CVE-2022-37967) (opens in a new tab)
- Microsoft Support KB5037754: PAC Validation Changes (CVE-2024-26248, CVE-2024-29056) (opens in a new tab)
- Microsoft Learn: Reset the krbtgt Password (Forest Recovery) (opens in a new tab)