Sporadic issues can be very difficult to pin down.

And depending on physical and virtual machines in the mix, troubleshooting can be challenging.

We used SCOM, so I had the luxury of being able to get some pretty good reports from a number of machines after the fact.

Lacking that, you might want to try capturing some of the basics on the 2 machines for a few minutes around the run time.

You also might want to mention this to whoever is Domain Admin.

More as a 'I'm having this problem...do you have any ideas on how to troubleshoot it?'

Most domain admins are glad to be able to prove authentication is working fine.

And may have some ideas on what they think you should check.