Kerberos Event ID 4771 (0x18) across multiple users while interactive logons succeed

Event 4771 with failure code 0x18 means a bad password was sent for Kerberos pre-authentication. Since the client address matches each user's own workstation, many users are failing from their own machines, outside working hours, and interactive logons still work, the usual cause is something running as those users with an old stored password, not an attack. A safe order that needs no new software on the workstations:

• Use the data you already have on the domain controllers. Compare 4771 against 4768 (a TGT request) and 4776 (NTLM validation) for the same user and time. If the same user also shows a successful 4768 right after, an app is retrying with a stale password while the logon itself is fine. Check the times: repeating at fixed intervals (every 10, 15 or 60 minutes) points to a scheduled task, service or sync client, and failures only after password changes point to cached credentials.
• Turn on the audit that names the process on the workstation. Enable Audit Logon failures (Logon/Logoff > Audit Logon) with a Group Policy on a small pilot group of computers, then look for 4625 events. They show the logon type (4 batch or scheduled task, 5 service, 8 or 9 for network or stored credentials), the process name and the caller. That is built in, harmless and reversible.
• Check the usual stored-credential suspects on one affected workstation: Credential Manager (Windows credentials), mapped drives that were set to reconnect with other credentials, scheduled tasks and services running as a user, Outlook, Teams and OneDrive sign-ins, and RDP or VPN profiles with a saved password.
• Only if that does not find it, take a short packet capture with pktmon or netsh trace on one workstation, filtered on port 88, and match the timestamp to the 4771. It also needs no install, and Sysmon is a last step.

If you see failures from the same workstation for many different usernames, treat that differently: that points to a shared service or a spray and should be handled separately.