Every hour, to the second, my DC logs four "Audit failure" events for my child domain admin account, the account eventually locks out. The event lists the forest rood DC as the client. I'm not logged on, there are no services, tasks, or processes running with my credentials that I can find. The events are always the same accept the port number changes. My environment is a multi-domain forest with trusts to other forests. Each DC is Windows 2008 R2, here is the info from the event. Any ideas??
eventID 4771:Kerberos pre-authentication failed.
Account Information:
Security ID: CHILDDOMAIN\ME
Account Name: Me
Service Information:
Service Name: krbtgt/ENTERPRISE
Network Information:
Client Address: ::ffff:10.10.10.10 (forest root DC)
Client Port: 55400
Additional Information:
Ticket Options: 0x40810010
Failure Code: 0x18
Pre-Authentication Type: 2