RTFM

Screenshot: 0x18 Pre-authentication information was invalid

0x18 Pre-authentication information was invalid which indicates the following condition: "Failure to obtain ticket, possibly due to the client providing the wrong password."

There are different types of events in the domain controller event log. All of them are very informative if you know the meanings. Kerberos events include IDs: 672, 673, 675, 676. To troubleshoot authentication problems or failure event logs you have to know how to translate the error codes of those events. You can turn on the event logging on a specific computer by following instructions on this page. Additional useful information is here.

A summary table goes below.

Continue Reading