The Privilege Attribute Certificate (PAC) is the authorization data block carried inside many Kerberos tickets in Windows domains. It can include the user’s identity, group memberships, logon time, and other claims that services use to decide what the ticket holder may access. The KDC and the service can sign or verify PAC data so the ticket is not only authenticated, but also tied to expected authorization details.
PACs matter because Kerberos is often trusted by file servers, applications, and domain services without rechecking a password. In attacks such as Golden Ticket abuse, an intruder may forge a ticket with a PAC that claims high-privilege groups, helping the forged identity blend into normal access decisions. Defenders watch for PAC inconsistencies, unusual group sets, missing or invalid signatures, and ticket contents that do not match directory data. Those signals can expose forged or tampered Kerberos material before it is used broadly.