Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          02.04.2020 14:00:03
Event ID:      4771
Task Category: Kerberos Authentication Service
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      dc01-4.NewCo.ptlab
Description:
Kerberos pre-authentication failed.

Account Information:
	Security ID:		NEWCO\service_sharepoint
	Account Name:		service_sharepoint

Service Information:
	Service Name:		krbtgt/NEWCO

Network Information:
	Client Address:		::ffff:10.125.6.144
	Client Port:		59320

Additional Information:
	Ticket Options:		0x40810010
	Failure Code:		0x18
	Pre-Authentication Type:	2

Certificate Information:
	Certificate Issuer Name:
	Certificate Serial Number:
	Certificate Thumbprint:

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options and failure codes are defined in RFC 4120.

If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-a5ba-3e3b0328c30d}" />
    <EventID>4771</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>14339</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8010000000000000</Keywords>
    <TimeCreated SystemTime="2020-04-02T11:00:03.430187200Z" />
    <EventRecordID>3211004</EventRecordID>
    <Correlation />
    <Execution ProcessID="640" ThreadID="4820" />
    <Channel>Security</Channel>
    <Computer>dc01-4.NewCo.ptlab</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">service_sharepoint</Data>
    <Data Name="TargetSid">S-1-5-21-473447165-2333059648-1334417953-1138</Data>
    <Data Name="ServiceName">krbtgt/NEWCO</Data>
    <Data Name="TicketOptions">0x40810010</Data>
    <Data Name="Status">0x18</Data>
    <Data Name="PreAuthType">2</Data>
    <Data Name="IpAddress">::ffff:10.125.6.144</Data>
    <Data Name="IpPort">59320</Data>
    <Data Name="CertIssuerName">
    </Data>
    <Data Name="CertSerialNumber">
    </Data>
    <Data Name="CertThumbprint">
    </Data>
  </EventData>
</Event>