I'm getting kerberos preauth failures - event 4771 - between my DCs. I think it's normal behavior (it's happened for years, since I enabled the additional logging), but I can't find any explanation as to why it is happening.
A couple notes:
- happening from domain controller
WENDEL to domain controller
- never occurs
STEVE does hold the FSMO roles.
- DCs are still on 2012r2, including operational level
All of the events have the same ticket details.
Ticket Options: 0x40810010
Failure Code: 0x18
Pre-Authentication Type: 2
I've done the usual dcdiag as a sanity check and nothing looked out of the ordinary.