How to trace security_error_ring_buffer_recorded errors in SQL Server 2014 Express
Take a look on this article: Troubleshooting ImpersonateSecurityContext in RING_BUFFER_SECURITY_ERROR


  The error message 5023 details are:
  
  “The group or resource is not in the correct state to perform the
  requested operation”
  
  According to Microsoft documentation “The ImpersonateSecurityContext
  function allows a server to impersonate a client by using a token
  previously obtained by a call to AcceptSecurityContext (General) or
  QuerySecurityContextToken. This function allows the application server
  to act as the client, and thus all necessary access controls are
  enforced.”
  
  Basically this function is called when impersonation is required. To
  do so, there must already be a valid context handle.
  
  Analyse error logs to identify Login failures and report on the state
  number.
  
  Some reasons I've spotted are:
  
  1) A service (set as Local System) on a server attempting to log on to
  SQL Server and not having access
  
  2) IP registered on the DNS server with the same FQDN


You can also check SQL Server error log to check if SPN was successfully registrated.