What you’re seeing
- The Security log on domain controllers fills with Event ID 4771 entries showing failure code 0x18.
- Failures appear for many different user accounts, often from the same handful of IP addresses.
- Users can log on normally when they try, yet failures continue in the background.
- SIEM or monitoring tools flag the volume as a possible password-spraying attack.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- Devices, services or scripts are presenting old cached passwords after users changed theirs.
- A system's clock differs from the domain controllers by more than the Kerberos tolerance, so encrypted timestamps fail.
- A shared kiosk, scanner or application server is configured with stale credentials for multiple accounts.
- Someone on the network is attempting passwords against many accounts in a spraying attack.
- Mobile devices or Wi-Fi clients using domain credentials retry with outdated passwords.
Why it matters
A flood of 4771 failures buries genuine attacks in noise and can trigger lockouts across many users. If the cause is a password-spraying attempt, the business is under active attack and every weak password is at risk. If it's a misconfiguration, the noise still wastes log storage, monitoring time and help desk effort. Either way, it needs to be explained rather than ignored.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Are we being attacked?
Possibly. Code 0x18 means a wrong password was used, which matches both stale credentials and password spraying. The engineer traces the sources so you know which it is.
Could this lock out our whole staff?
If the failures cross your lockout threshold, yes. Identifying the source quickly prevents widespread lockouts.