2.7 PAC_CLIENT_INFO

The PAC_CLIENT_INFO structure is a variable length buffer of the PAC that contains the client's name and authentication time. It is used to verify that the PAC corresponds to the client of the ticket. The PAC_CLIENT_INFO structure is placed directly after the Buffers array of the topmost PACTYPE structure (section 2.3), at the offset specified in the Offset field of the corresponding PAC_INFO_BUFFER structure (section 2.4) in the Buffers array. The ulType field of the corresponding PAC_INFO_BUFFER is set to 0x0000000A. 

The PAC_CLIENT_INFO structure is defined as follows.

       typedef struct _PAC_CLIENT_INFO {
           FILETIME ClientId;
           USHORT NameLength;
           WCHAR Name[1];
       } PAC_CLIENT_INFO, *PPAC_CLIENT_INFO;

The format of the PAC_CLIENT_INFO structure is defined as follows.

0	1	2	3	4	5	6	7	8	9	1 0	1	2	3	4	5	6	7	8	9	2 0	1	2	3	4	5	6	7	8	9	3 0	1
ClientId
...
NameLength																Name (variable)
...

ClientId (8 bytes): A FILETIME structure in little-endian format that contains the Kerberos initial ticket-granting ticket (TGT) authentication time, as specified in [RFC4120] section 5.3.

NameLength (2 bytes): An unsigned 16-bit integer in little-endian format that specifies the length, in bytes, of the Name field.

Name (variable): An array of 16-bit Unicode characters in little-endian format that contains the client's account name.