The ticket authtime of a Samba generated S4U2Proxy ticket and the logon_time in the PAC_LOGON_NAME mismatch, because the ticket authtime is not taken from the additional ticket.
Created attachment 13865 [details] Work in progress patch