Event code: 4005 Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.

Recently some CIS Windows hardening policies were applied to one of our Windows 2012R2 Datacenter servers.

When smoke testing the web applications on these servers, we discovered that the authentication no longer worked and we are now receiving 403 errors when accessing the web applications:

403 - Forbidden: Access is denied.

You do not have permission to view this directory or page using the credentials that you supplied.

In the Windows Event Viewer the following information event is logged:

Event code: 4005
Event message: Forms authentication failed for the request. Reason: The ticket supplied has expired.
Event time: 5/2/2017 9:02:30 AM
Event time (UTC): 5/2/2017 2:02:30 PM
Event ID: 5dd78f5603644e26b620998f702d0923
Event sequence: 22
Event occurrence: 10
Event detail code: 50202 

I saw some similar errors where this problem was resolved by regenerating a Machine Key, however that did not work.

Any idea of next steps in finding the root cause of this issue?

Thanks.