This is done by a Windows KDC. I've seen it in a PAC, but haven't cross checked a netr_LogonSamLogonEx response.
*** This bug has been marked as a duplicate of bug 11362 ***