Mapping Azure Fileshares - getting "The specified network password is not correct." for 1 sa but not for another

Question

here's the layout - 3 subscriptions, each with their own vNet - 1 Core subscription with 2 spokes peered to the core but not to each other - Route Tables in the spokes point to a firewall in Core which passes traffic onwards to the other spoke - no known issues there

However, 1 VM in spoke A needs to connect to 2 file shares - 1 file share on a Files SA in Spoke A & 1 file share on a Files SA in Spoke B

Both SAs are configured the same as far as i can see - they are both configured to use AD DS - user is Contributor on both SAs

the file share from Spoke A maps correctly without asking for credentials

the file share from Spoke B fails to map and asks for credentials - rejecting the password when it is entered with the error "The specified network password is not correct."

i have gone through every setting in the 2 accounts and they look the same

it is the same VM and the same user trying to connect - but 1 works and 1 fails.

Any help would be appreciated

Answer 1

Thanks for posting your question in the Microsoft Q&A forum.

I recommend reviewing the following aspects:

• Ensure that the Storage Account in Spoke B is not configured to restrict access to specific IP ranges or virtual networks
• If the network connectivity seems fine, try mapping the file share using the IP address of the Storage Account instead of the DNS name
• If the issue persists, consider creating a new file share in Spoke B and testing the connection again

---

Please don't forget to close up the thread here by upvoting and accept it as an answer if it is helpful

Answer 2

Hello,

 

Thank you for posting in Q&A forum.

To further check this issue, please kindly follow steps below:

1.Run below PowerShell command to check if you can resolve the storage account name:

Test-netconnection -computername <storageaccount>.file.core.windows.net -port 445

It will help check if you have proper network access to the storagea account.

2.It can also be caused by the authentication issue, you can refer to below Microsoft Official Documentation for further details.

https://learn.microsoft.com/en-gb/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal

3.Run network monitor or wireshark when reproducing the issue and capture the network trace. In the trace you will get more insights and information.

Hope this answer can help you well.

 

Best regards，

Jill Zhou

Answer 3

Hello Jane Cassell,

Greetings! Welcome to Microsoft Q&A Platform.

Thank you for providing the detailed layout and issue description! Please check the below following and troubleshoot the issue,

• Confirm that the user’s credentials are correctly configured for both file shares in Spoke A and Spoke B and ensure that the user has the necessary permissions (Contributor role) on both storage accounts (SAs).
• Verify the Synchronization setting - It's under the Synchronization settings menu for Azure AD Domain Services. You can then change the scope from 'Scoped' to 'All'. refer - https://learn.microsoft.com/en-gb/azure/storage/files/storage-files-identity-auth-domain-services-enable?tabs=azure-portal for detailed guidance.
• On-premises Active Directory Domain Services (AD DS) integration with Azure Files provides the methods for storing directory data while making it available to network users and administrators. Security is integrated with AD DS through logon authentication and access control to objects in the directory. With a single network logon, administrators can manage directory data and organization throughout their network, and authorized network users can access resources anywhere on the network. AD DS is commonly adopted by enterprises in on-premises environments or on cloud-hosted VMs, and AD DS credentials are used for access control. For more information, see Active Directory Domain Services Overview. Refer to this article which provides detailed information Overview - on-premises Active Directory Domain Services authentication over SMB for Azure file shares
• Check the storage account firewall configuration. Ensure that the firewall is correctly configured to allow access from the client machine's IP address or subnet.
• Check the network connectivity between the client machine and the storage account. Ensure that there are no network issues that are preventing the client machine from connecting to the storage account.
• Based on the error message, please refer to the suggestion mentioned in the below link.
  https://learn.microsoft.com/en-us/answers/questions/869793/azure-files-network-password-is-not-correct-when-u
  I would also recommend to cross verify the perquisites Overview - on-premises Active Directory Domain Services authentication over SMB for Azure file shares
• There is a video which gives detailed information on Azure files Integration with AAD Replacing on-premises file servers with Azure Files (including setup on private link for files and AD authentication) Additional information: Azure Files, network password is not correct when using storage account key Network password incorrect using Azure AD DS Identity
• Confirm the name resolution working correctly NRPT (Name resolution policy table) was applying correctly by running

    Test-netconnection -computername <storageaccount>.file.core.windows.net -port 445
  

  Set the registry subkey KEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\DisableDomainCreds - Set the value to 1 After doing the drive mapped. My understand is with this registry subkey set to 1 - the device will always query the domain and not use the cached creds.

Hope this answer helps! Please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.