Failed logon attempts for Alternate Service Account

Question

Hello team. I've got an interesting problem where I see event 4625 in the Security Log for my ASA. The failure reason says "Unknown user name or bad password"

Environment: Exchange 2013 CU 23, Windows Server 2012 R2, Forest + Domain functional level - 2012 R2, Load Balancers, Kerberos Authentication, No forest-to-forest trusts. Many child domains.

Issue: ASA account shows failed logon attempts in Event Viewer on the Exchange server, but not on the domain controller. It shows successful attempts on the DC, but failed attempts on the Exchange Server. NOTE: This is only happening at one site as far as I know. There are multiple ASAs. I think this is because they are using site-based namespaces and so they delegate site-specific SPNs to the site specific ASA.

Troubleshooting done so far:

1. Re-rolled out ASA credentials to the site Exchange Client Access Servers. Interestingly enough, once this was done, the error being reported changed from “…using a bad password” to “…using an old password.”
2. Found and removed stored credentials by running “rundll32 keymgr.dll,KRShowKeyMgr” as the local system account (done by using PSExec).
3. Checked IIS and the virtual directories don't indicate any basic authentication happening

Other info: Looking at the event log, it logs event ID 4625 (more description here for this ASA with a logon type of 8, which is supposedly “NetworkCleartext,” which implies that it is having issues with IIS logins using Basic Authentication. The Authentication Package in the event log info mentions using “Negotiate” and the Logon Process is “Advapi,” so I don’t see how it would be an issue with trying to use Basic Authentication. The caller process seems to be the Exchange svchost process ($env:ExchangeInstallPath\Bin\Microsoft.Exchange.ServiceHost.exe)

Is this some sort of expected behavior? Also, my question was previous posted here