Azure Files, network password is not correct when using storage account key

Question

I am trying to map an Azure file share to my client using the storage account key. I am using the script you get from the Azure portal.

cmd.exe /C "cmdkey /add:`"StorageAccountName.file.core.windows.net`" /user:`"localhost\StorageAccountName`" /pass:`StorageAccountPassword`""

New-PSDrive -Name Z -PSProvider FileSystem -Root "\\StorageAccountName.file.core.windows.net\FileShareName" -Persist

As I run the above Powershell script, the key is mapped successfully but after that I get the following error:

New-PSDrive : The specified network password is not correct
At line:6 char:5
+     New-PSDrive -Name Z -PSProvider FileSystem -Root "\\StorageAccountNa ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (Z:PSDriveInfo) [New-PSDrive], Win32Exception
    + FullyQualifiedErrorId : CouldNotMapNetworkDrive,Microsoft.PowerShell.Commands.NewPSDriveCommand

The connection test is successful and there are no issues with firewalls or encryption. I am using SMB 3.0 or higher with AES256.

Any help would be greatly appreciated.

Answer 1

Hi, I was in same situation.

I enabled "NTLMv2" for authentication with Account Key.
(Before that I used "Maiximum security" on Protocol settings)

It worked for me.

ref: https://learn.microsoft.com/en-us/azure/storage/files/storage-files-planning#available-protocols

Answer 2

@Jukka Nieminen Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Based on the error message, can you please cross verify port 445 is enabled

If few Internet provider have blocked port 445, please refer to this article

SMB has always been a network file sharing protocol. As such, SMB requires network ports on a computer or server to enable communication to other systems. SMB uses either IP Port 445 . 445 is an important port because it is used by default for all SMB communication. Windows uses it for various functions since SMB serves as the network protocol at the application level.

Symptoms
You have found that the TCP port 445 is blocked.

Customer can talk to the ISP to check if they can allow all communication to URLS ".file.core.windows.net " (Suffix used for storage accounts) and ".store.core.windows.net" (Suffix used by the storage stamp).

Resolution:
Solution 1 - Use Azure File Sync
Azure File Sync can transform your on-premises Windows Server into a quick cache of your Azure file share. You can use any protocol that's available on Windows Server to access your data locally, including SMB, NFS, and FTPS. Azure File Sync works over port 443 and can thus be used as a workaround to access Azure Files from clients that have port 445 blocked. Learn how to setup Azure File Sync.

Solution 2 - Use VPN
By Setting up a VPN to your specific Storage Account, the traffic will go through a secure tunnel as opposed to over the internet. Follow the instructions to setup VPN to access Azure Files from Windows.

Solution 3 - Unblock port 445 with help of your ISP/IT Admin
Work with your IT department or ISP to open port 445 outbound to Azure IP ranges.

Solution 4 - Use REST API based tools like Storage Explorer/Powershell
Azure Files also supports REST in addition to SMB. REST access works over port 443 (standard tcp). There are various tools that are written using REST API which enable rich UI experience. Storage Explorer is one of them. Download and Install Storage Explorer and connect to your file share backed by Azure Files. You can also use PowerShell which also user REST API.

Additional information: You can mount the file share on your local machine by using the SMB 3.0 protocol, or you can use tools like Storage Explorer to access files in your file share. From your application, you can use storage client libraries, REST APIs, PowerShell, or Azure CLI to access your files in the Azure file share.

Azure Files only allows connections using SMB 3.0 (with encryption support) from outside the region or datacenter. SMB 3.0 protocol has introduced many security features including channel encryption which is very secure to use over internet. However its possible that port 445 has been blocked due to historical reasons of vulnerabilities found in lower SMB versions. In ideal case, the port should be blocked for only for SMB 1.0 traffic and SMB 1.0 should be turned off on all clients.

If you still face any issue in mounting Azure file share, please let me know I would like to work closer on this issue

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 3

Hi,

Just as @Jukka Nieminen is commenting, I have the port 445 available and not blocked. However, I get the same "The specified network password is not correct" error message.

I have not found any solution to this problem. Not even by turning on AD configurations. Errors present on both scenarios.

Thanks.

Answer 4

The script for mounting to windows is generating bad syntax specifically in the user and password fields when using the Storage Account Key method of auth. There will be extra ' characters in the script and this will cause your auth to fail every time. Clean up that part and see if you're still having the issue.