cannot stablished NTLM authentication channel with Domain

Do you have AD SSO (Kerberos/NTLM) enabled? 

Yes, i did.

Are you using already MR4?

Yes, im using SFOS 18.0.4 MR-4.

The question would rather be : You want to use Kerberos/NTLM? It looks like its not configured properly. Hence the question, if you actually need kerberos/Ntlm. 

See https://docs.sophos.com/nsg/sophos-firewall/18.0/Help/en-us/webhelp/onlinehelp/nsg/sfos/learningContent/AuthenticationKerberosTurnOn.html

Yes, we use STAS. Before we updated our Sophos, everything was OK. After the update I get these logs.

STAS is not Kerberos/NTLM. This is a new technology, included in V18. Hence you are seeing this. If you not use this technology, simply disable AD SSO on the Administration - Device Access. STAS will be enabled via Client authentication. You should not experience an issues. 

I disabled AD SSO, but I still get these logs.

On all Zones? 

Yes.