<div>
Thank you for your feed back. All the article i have read seem to point out this is normal but was concerned this could have &nbsp;been some type of attack on the RODC
</div>


<div>
<div class="content wysiwyg-content">
We have a Windows 2016 RODC running server core in our DMZ. That is restricted via our firewall on which DC's internally it can communicate with. Sporadically we i.e once every other week get the following error message on one of the internal DC's the RODC can talk to. &quot;During TGS processing, the KDC was unable to verify the signature on the PAC from RODCNA1$. This indicates the PAC was modified.&quot; Search online seems to point out this is normal but my problem is if this is normal they why is is an error
</div>
</div>


We have a Windows 2016 RODC running server core in our DMZ. That is restricted via our firewall on which DC's internally it can communicate with. Sporadically we i.e once every other week get the following error message on one of the internal DC's the RODC can talk to. "During TGS processing, the KDC was unable to verify the signature on the PAC from RODCNA1$. This indicates the PAC was modified." Search online seems to point out this is normal but my problem is if this is normal they why is is an error

Kerberos PAC Errors

Windows Server 2016 is the successor to Windows Server 2012 R2. Built upon the same core code as Windows 10, Windows Server 2016 brings enhancements in security, servicing, and connectivity. A particular focus on this release was hybrid-cloud scenarios, and has close ties to Azure and other Microsoft cloud initiatives. This does not detract from the many improvements that are available for on-premises-only deployments

Windows Server 2016 comes in Datacenter, Standard, and Essentials editions, and for servicing, has adopted windows 10's cumulative model. The new nano-server install is designed to be remotely managed and is designed to be kept current through continuous feature updates. The full GUI install operates similarly to windows 10's "Long Term Servicing Branch" (LTSB) model with cumulative security updates.

Windows Server 2016 has also shifted from a per-processor-and-CAL licensing model to a per-core-and CAL licensing model. This brings Windows Server's licensing more in line with Microsoft's other products and makes hybrid-cloud license planning easier as well.

Windows Server 2016

Active Directory (AD) is a Microsoft brand for identity-related capabilities. In the on-premises world, Windows Server AD provides a set of identity capabilities and services, and is hugely popular (88% of Fortune 1000 and 95% of enterprises use AD). This topic includes all things Active Directory including DNS, Group Policy, DFS, troubleshooting, ADFS, and all other topics under the Microsoft AD and identity umbrella.