It turns out that the Netlogon PAC verification is encrypted.