Kerberos client received KRB_AP_ERR_MODIFIED

What it means

A ticket couldn’t be decrypted by the target server, usually because two computers share a name or DNS points to the wrong machine.

Why it matters

Causes intermittent "access denied" and authentication failures to file servers and apps.

What to do

• Check DNS for duplicate or stale records of the target server.
• Look for duplicate SPNs with setspn -X.

Find it with PowerShell

Get-WinEvent -MaxEvents 20 -FilterHashtable @{
  LogName = 'System'; Id = 4
} | Select-Object TimeCreated, ProviderName, Message

Add -ComputerName SERVER to query another machine. Other event sources can reuse the same ID number, so check the ProviderName column.