Skip to content

Add manual configuration script for AD DS authentication #128415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
eliaquimbrandao wants to merge 5 commits into from
+116 −0
Closed

Add manual configuration script for AD DS authentication #128415

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
87dc103
Add manual configuration script for AD DS authentication
eliaquimbrandao Apr 15, 2026
971b713
Refactor PowerShell variables for clarity
eliaquimbrandao Apr 15, 2026
c65fcac
Update ActiveDirectorySamAccountName variable name
eliaquimbrandao Apr 15, 2026
d7fdb19
Update computer account references in AD commands
eliaquimbrandao Apr 15, 2026
714c549
Add confirmation steps for AD DS feature
eliaquimbrandao Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
116 changes: 116 additions & 0 deletions articles/storage/files/storage-files-identity-ad-ds-enable.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,122 @@ Set-ADAccountPassword -Identity <domain-object-identity> -Reset -NewPassword $Ne
> [!IMPORTANT]
> If you previously used RC4 encryption and updated the storage account to use AES-256 (recommended), run `klist purge` on the client and then remount the file share to get new Kerberos tickets with AES-256.

## End-to-end script for manual configuration
This section provides a consolidated, script-based approach for manual configuration. It is intended for advanced scenarios where execution is performed across multiple teams (Azure and Active Directory), offering a single, ordered workflow that mirrors the manual steps described above.

> [!NOTE]
> These scripts assume that the Active Directory object (computer account or service account) already exists and that the required domain and identity information is available in your environment.

### [Computer account (recommended)](#tab/computer-account)

```powershell
# VARIABLES
$ResourceGroupName = "<ResourceGroupName>"
$StorageAccountName = "<StorageAccountName>"
$ComputerName = "<ComputerAccountName>" # Base computer account name, without trailing $
$ComputerSam = "$ComputerName`$" # Computer account sAMAccountName

$DomainDNSRoot = "<domain-dns-root>"
$DomainNetBIOS = "<domain>"
$ForestName = "<forest-name>"
$DomainGuid = "<domain-guid>"
$DomainSid = "<domain-sid>"
$StorageSid = "<storage-account-sid>"

# STEP 1 – Generate Kerberos key (Azure team)
New-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -KeyName kerb1
$KerbKey = (Get-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -ListKerbKey | Where-Object {$_.KeyName -eq "kerb1"}).Value

# STEP 2 – Set SPN (AD team)
setspn -S cifs/$StorageAccountName.file.core.windows.net $ComputerSam

# STEP 3 – Set password (AD team)
$SecurePassword = ConvertTo-SecureString $KerbKey -AsPlainText -Force
Set-ADAccountPassword -Identity $ComputerSam -Reset -NewPassword $SecurePassword

# STEP 4 – Enable AD DS authentication (Azure team)
Set-AzStorageAccount `
-ResourceGroupName $ResourceGroupName `
-Name $StorageAccountName `
-EnableActiveDirectoryDomainServicesForFile $true `
-ActiveDirectoryDomainName $DomainDNSRoot `
-ActiveDirectoryNetBiosDomainName $DomainNetBIOS `
-ActiveDirectoryForestName $ForestName `
-ActiveDirectoryDomainGuid $DomainGuid `
-ActiveDirectoryDomainSid $DomainSid `
-ActiveDirectoryAzureStorageSid $StorageSid `
-ActiveDirectorySamAccountName $ComputerName `
-ActiveDirectoryAccountType "Computer"

# STEP 5 – Configure AES-256 encryption (AD team - recommended)
Set-ADComputer -Identity $ComputerSam -KerberosEncryptionType "AES256"

# STEP 6 – Regenerate Kerberos key (Azure team)
New-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -KeyName kerb1
$KerbKey = (Get-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -ListKerbKey | Where-Object {$_.KeyName -eq "kerb1"}).Value

# STEP 7 – Reset password with new key (AD team)
$SecurePassword = ConvertTo-SecureString $KerbKey -AsPlainText -Force
Set-ADAccountPassword -Identity $ComputerSam -Reset -NewPassword $SecurePassword
```

### [Service logon account (user)](#tab/user-account)
Comment thread
eliaquimbrandao marked this conversation as resolved.

```powershell
# VARIABLES
$ResourceGroupName = "<ResourceGroupName>"
$StorageAccountName = "<StorageAccountName>"
$UserSamAccountName = "<UserSamAccountName>"

$DomainDNSRoot = "<domain.com>"
$DomainNetBIOS = "<domain-netbios-name>"
$ForestName = "<forest-name>"
$DomainGuid = "<domain-guid>"
$DomainSid = "<domain-sid>"
$StorageSid = "<storage-account-sid>"

# STEP 1 – Generate Kerberos key (Azure team)
New-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -KeyName kerb1
$KerbKey = (Get-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -ListKerbKey | Where-Object {$_.KeyName -eq "kerb1"}).Value

# STEP 2 – Set SPN (AD team)
setspn -S cifs/$StorageAccountName.file.core.windows.net $UserSamAccountName

# STEP 3 – Set UPN (AD team)
Set-ADUser -Identity $UserSamAccountName -UserPrincipalName "cifs/$StorageAccountName.file.core.windows.net@$DomainDNSRoot"

# STEP 4 – Set password (AD team)
$SecurePassword = ConvertTo-SecureString $KerbKey -AsPlainText -Force
Set-ADAccountPassword -Identity $UserSamAccountName -Reset -NewPassword $SecurePassword

# STEP 5 – Enable AD DS authentication (Azure team)
Set-AzStorageAccount `
-ResourceGroupName $ResourceGroupName `
-Name $StorageAccountName `
-EnableActiveDirectoryDomainServicesForFile $true `
-ActiveDirectoryDomainName $DomainDNSRoot `
-ActiveDirectoryNetBiosDomainName $DomainNetBIOS `
-ActiveDirectoryForestName $ForestName `
-ActiveDirectoryDomainGuid $DomainGuid `
-ActiveDirectoryDomainSid $DomainSid `
-ActiveDirectoryAzureStorageSid $StorageSid `
-ActiveDirectorySamAccountName $UserSamAccountName `
-ActiveDirectoryAccountType "User"

# STEP 6 – Configure AES-256 encryption (AD team - recommended)
Set-ADUser -Identity $UserSamAccountName -KerberosEncryptionType "AES256"

# STEP 7 – Regenerate Kerberos key (Azure team)
New-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -KeyName kerb1
$KerbKey = (Get-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -Name $StorageAccountName -ListKerbKey | Where-Object {$_.KeyName -eq "kerb1"}).Value

# STEP 8 – Reset password with new key (AD team)
$SecurePassword = ConvertTo-SecureString $KerbKey -AsPlainText -Force
Set-ADAccountPassword -Identity $UserSamAccountName -Reset -NewPassword $SecurePassword
```

---

## Confirm the feature is enabled

Check if AD DS is enabled as the identity source on your storage account by using the following script. Replace `<resource-group-name>` and `<storage-account-name>` with your values.
Expand Down