Azure-docs: Kerberos key not found

[skadeb87]

Ensure-KerbKeyExists : Unable to generate a Kerberos key for storage account: storageaccount.
This might be because the 'Azure Files Authentication with Active Directory' feature is not yet available in
this location (eastus)

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: fba964be-3f77-d80c-f1a5-35bb1430bb8f
• Version Independent ID: fe70b11e-10fe-5a8c-1fad-b22a83693503
• Content: Enable Active Directory authentication over SMB for Azure Files
• Content Source: articles/storage/files/storage-files-active-directory-domain-services-enable.md
• Service: storage
• GitHub Login: @roygara
• Microsoft Alias: rogarana

[SumanthMarigowda-MSFT]

@skadeb87 Thanks for your question. We are checking on this and will respond to you soon.

[yuemlu]

@skadeb87 Correct. Feel free to try out in a region where Preview is supported.

[alexsys14]

Is there any info, when it will be available in West US 2 region? Thanks.

[Pawel1985]

I've the same issue in West Europe, but also tried Easu US and
Ensure-KerbKeyExists : Unable to generate a Kerberos key for storage account:

[yuemlu]

@Pawel1985 and @alexsys14 Here is a list of regions where Azure Files AD Authentication is supported. Please consider to try in these regions.

[Pawel1985]

I know, I'm trying west europe,
Ensure-KerbKeyExists : Unable to generate a Kerberos key for storage account: plwaw1fs01sa01.
This might be because the 'Azure Files Authentication with Active Directory' feature is not yet available in this location (westeurope).

[brophis]

Hi,

I'm not a coder so please excuse me if i'm way off the mark.

I have the same issue. I noticed that there was an error on line 2126 where the if condition was typed backwards. It was typed as "if ($null -eq $kerb1Key)" instead of the other way around. In hindsight this probably actually doesn't matter.

Also if I try run:
New-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -KeyName "kerb1"
I get New-AzStorageAccountKey : Key name kerb1 is not valid.
Looks like this may be the main issue where we can't create the kerberos keys.
I tried new storage accounts, standard and premium and no change.

I manged to makes some changes the the powershell module from the private preview and got to near the end of the script but it ended with and error:
Set-AzStorageAccount : A feature was requested which is not yet available in this location.

Below is the original error:

Ensure-KerbKeyExists : Unable to generate a Kerberos key for storage account: [removed name].
This might be because the 'Azure Files Authentication with Active Directory' feature is not yet available in this
location (northeurope).
At C:\Users\username\Documents\WindowsPowerShell\Modules\AzFilesHybrid\0.1.0.0\AzFilesHybrid.psm1:3286 char:13

• Ensure-KerbKeyExists -ResourceGroupName $ResourceGroupNam ...
• ~~~~~~~~~~~~~
  
  
  
  • CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
  
  
  • FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,Ensure-KerbKeyExists
  
  

I hope this helps

[skadeb87]

@skadeb87 Correct. Feel free to try out in a region where Preview is supported.

@yuemlu East US is listed in the supported region list and that is where I am trying and receiving the error message.

[brophis]

@skadeb87 I made the same mistake as you. The list provided is the list of regions where the service is NOT available 🤦‍♂️

[yuemlu]

@SumanthMarigowda-MSFT can we close this?

[mikewillodea]

Ive just tried to set this up in region (australiaeast) and having the same issue? Yet the link of available regions has this location as an Available Region? Am i missing something here?

[siim-m]

I'm also having the same issue in Australia East, although it is not in the "not available" list.

Ensure-KerbKeyExists : Unable to generate a Kerberos key for storage account: <ACCOUNT NAME>.
This might be because the 'Azure Files Authentication with Active Directory' feature is not yet available in this location (australiaeast)

[adeelaleem]

Hi guys,
west europe location is still not supported. Kindly make it available because we have a lot of new deployment comings next weeks. I want to leverage user profiles on Azure files with on-premises Active directory.

[steelburger]

Hi guys,

Would be great if can include error 1396 troubleshooting guide. I encountered this error while trying to map the files share to AD joined machines.

System error 1396 has occurred.
The target account name is incorrect.

"Join-AzStorageAccountForAuth" ran successfully with Provisioning State shown as Succeeded.
The Computer Account in local AD was already created successfully.
"Get-AzStorageAccountKey -ListKerbKey | ft KeyName" also returned 2 kerb keys.
The RBAC Storage permissions were also assigned to the corresponding Azure AD accounts to access the File Share.

[dkattan]

I am also receiving the error

Ensure-KerbKeyExists : Unable to generate a Kerberos key for storage account: abtesting2.
This might be because the 'Azure Files Authentication with Active Directory' feature is not yet available in this location (centralus).

The documentation linked to by @yuemlu (https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable#regional-availability) shows:

Regional availability
Azure Files authentication with AD DS (preview) is available in all Public regions and Azure Gov regions.

But the post made more recently (March 12) by @SumanthMarigowda-MSFT (https://github.com/MicrosoftDocs/azure-docs/issues/49931#issuecomment-598144351) indicates that it is NOT available in
West US
West US 2
East US
East US 2
West Europe
North Europe

Can someone please update the documentation to correctly indicate the supported regions instead of incorrectly stating it is available in all regions?

Further, I am trying to use this in centralus which is not in the excluded list and it isn't working.

[dkattan]

@wmgries I'm trying to following along with your video but I am getting

Ensure-KerbKeyExists : Unable to generate a Kerberos key for storage account: abtesting2.
This might be because the 'Azure Files Authentication with Active Directory' feature is not yet available in this location (centralus).

The documentation states this feature is available in all regions:
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable#regional-availability

Any ideas?

[ziesemer]

Same issue here in usgovarizona , despite previous success in uscentral. Ticket # 120060624001372 opened with Microsoft Partner Support regarding...