Kerberos Event ID 4771 (0x18) occurring for all domain users despite successful manual logons

Hello,

At one of our clients, we are experiencing repeated Kerberos Pre-Authentication Failed - Event ID 4771, with Failure Code 0x18, on the primary Domain Controller.

The issue affects all domain users. All users are able to log in manually without any issues using their credentials. However, Event ID 4771 failures continue to be generated in the background, including outside normal working hours.

From the Event ID 4771 entries, we can see authentication attempts originating from different internal systems, including user workstations, the secondary Domain Controller, and the proxy server.

As part of the troubleshooting, we performed the following command for one of the affected users in order to clear the Kerberos ticket cache:

klist purge

The cache was cleared successfully, but after monitoring the environment again, Event ID 4771 continued to be generated and the issue remained unchanged.

We would appreciate your assistance in identifying the root cause of these repeated Kerberos pre-authentication failures and advising us on the recommended next troubleshooting steps.

Thank you.