The event is triggered every few seconds. Pre-authentication failed is not clear. It doesn't say bad password, but the account keeps locking.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:46:05 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61196 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:46:05 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61194 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:45:12 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61190 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:45:12 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61188 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:45:05 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61186 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:45:05 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61184 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:48 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61182 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:48 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61180 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:37 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61178 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:37 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61176 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:26 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61174 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:26 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61172 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:15 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61170 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:15 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61168 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:04 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61163 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:44:04 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61161 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:43:05 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61152 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:43:05 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj Service Information: Service Name: krbtgt/domain.local Network Information: Client Address: ::ffff:192.168.20.111 Client Port: 61150 Additional Information: Ticket Options: 0x40810010 Failure Code: 0x18 Pre-Authentication Type: 2 Certificate Information: Certificate Issuer Name: Certificate Serial Number: Certificate Thumbprint: Certificate information is only provided if a certificate was used for pre-authentication. Pre-authentication types, ticket options and failure codes are defined in RFC 4120. If the ticket was malformed or damaged during transit and could not be decrypted, then many fields in this event might not be present.
4771,AUDIT FAILURE,Microsoft-Windows-Security-Auditing,Tue Mar 26 05:42:07 2013,No User,Kerberos pre-authentication failed. Account Information: Security ID: S-1-5-21-1614895754-515967899-1801674531-1163 Account Name: smithj S
The IP address is to a webmail server. The user says they have turned off everything that is checking mail.
I don't know why I don't see any events that say "unknown user name or bad password", yet the account locks anyway.