Issue with get in to RDP server. Authentication issues (event 4634 and 4768).

Hello.

I have a server that's having trouble logging in for some (not all) domain users.

The server accepts credentials (correct), then loads the RDP session window, and then, on the username and password entry screen, reports that the username or password is incorrect. However, on the server, I see the login as contoso.com******@contoso.com, even though I entered user\contoso.com.

Some domain users can log in.

Logging in with a local account works fine.

Connecting to a shared directory or system directory using NTLM with the same domain credentials works.

The problem is with Keberos on this machine. It's no different from other similar RDP servers.

I checked the trust relationships with the domain controller and they are fine.

I checked for time discrepancies; there are no net discrepancies, and synchronization is working, even though the server is in a different time zone. I checked the domain controllers' availability, and everything is fine.

I'm seeing server-related errors on the domain controller:

Log Name: Security

Event ID: 4768

Task Category: Kerberos Authentication Service

Keywords: Audit Failure

Computer: controller.contoso.com

Description:

A Kerberos authentication ticket (TGT) was requested.

Account Information:

*Account Name:		host-a$*

*Supplied Realm Name:	contoso.LOCAL*

*User ID:			NULL SID*

*MSDS-SupportedEncryptionTypes:	-*

*Available Keys:	-*
```*Service Information:*

```sql
*Service Name:		krbtgt/contoso.LOCAL*

*Service ID:		NULL SID*

*MSDS-SupportedEncryptionTypes:	-*

*Available Keys:	-*
```*Domain Controller Information:*

```sql
*MSDS-SupportedEncryptionTypes:	-*

*Available Keys:	-*
```*Network Information:*

```typescript
*Client Address:		::ffff:10.0.10.250*

*Client Port:		59523*

*Advertized Etypes:	-*
```*Additional Information:*

```javascript
*Ticket Options:		0x40810010*

*Result Code:		0xE*

*Ticket Encryption Type:	0xFFFFFFFF*

*Session Encryption Type:	0x2D*

*Pre-Authentication Type:	-*

*Pre-Authentication EncryptionType:	0x2D*
```*Certificate Information:*

```sql
*Certificate Issuer Name:*		

*Certificate Serial Number:*	

*Certificate Thumbprint:*		
```*Ticket information*

```yaml
*Response ticket hash:		-*
```*Certificate information is only provided if a certificate was used for pre-authentication.*

**On RDP host side**

*The server responds, "Login or password is invalid." In the Event Log, I do see event 4625 (Audit Failure) - An account failed to log on.*

*Failure Reason: An Error occurred during Logon.*

*Status: 0xC000006D*

*Sub Status: 0x0*

*Account For Which Logon Failed:*

*Security ID: NULL SID*

*Account Name: myaccount@contoso.local*

*Account Domain: contoso.local*

*Although the login and password are correct, of course.*

I could try: re-creating the security channel, updating the server, explicitly enabling supported Keberos encryption, removing the server from the domain, and then re-adding it to the domain.

However, I won't have much time for this because this is a production server. I'd like to be clear on my next steps.

Thanks in advance for your advice.