Home / Azure

AzureTroubleshootingBeginner

Azure Files share won't mount: port 445, authentication and SMB version fixes

Fix "System error 53", error 5 and mount timeouts on Windows and Linux by checking port 445, credentials, identity-based auth and SMB encryption settings.

Deepak Bhardwaj2 min read

Applies toAzure Files (SMB), Windows 10/11 and Server, Linux cifs-utils

1. Can the client reach port 445?

Test-NetConnection -ComputerName stfiles01.file.core.windows.net -Port 445

nc -zvw3 stfiles01.file.core.windows.net 445

TcpTestSucceeded : False is the most common cause of all. Many ISPs and corporate networks block outbound 445. Options:

  • Connect over VPN or ExpressRoute with a private endpoint.
  • Use Azure File Sync to a local Windows server.
  • Use the REST/HTTPS access path (Storage Explorer, AzCopy) instead of SMB.

2. Error codes on Windows

Error Meaning Fix
System error 53 / 67 Network path not found Port 445 blocked, or wrong FQDN
System error 5 (Access denied) Bad credentials or missing share permission Check the key, or the identity's share-level role
System error 1326 Username or password incorrect With a storage key, the user is localhost\<account> (or Azure\<account>)
System error 86 Same as 1326 on some builds As above
Mount succeeds, then Access denied on folders NTFS ACLs (identity-based auth) Set ACLs with icacls as an admin

Mount with the storage key (testing, or non-domain clients):

cmd /c "cmdkey /add:stfiles01.file.core.windows.net /user:localhost\stfiles01 /pass:<storage-key>"
New-PSDrive -Name Z -PSProvider FileSystem -Root "\\stfiles01.file.core.windows.net\share1" -Persist

3. Identity-based auth (AD DS / Entra Kerberos)

  • The storage account is domain-joined, or Entra Kerberos is enabled.
  • The user has a share-level RBAC role: Storage File Data SMB Share Reader / Contributor / Elevated Contributor.
  • The client can reach a domain controller (AD DS) and gets a ticket: klist get cifs/stfiles01.file.core.windows.net
  • The NTFS ACLs on the folder grant the user access.

4. Linux mounts

sudo mkdir -p /mnt/share1
sudo mount -t cifs //stfiles01.file.core.windows.net/share1 /mnt/share1 \
  -o vers=3.1.1,credentials=/etc/smbcredentials/stfiles01.cred,dir_mode=0770,file_mode=0660,serverino,nosharesock,actimeo=30

mount error(13): Permission denied → wrong key, or the storage account requires encryption the kernel can't do. mount error(2) → wrong share name. Use SMB 3.1.1, because older kernels lacking SMB 3 encryption can't connect when Secure transfer required is on.

5. Security settings on the account

az storage account file-service-properties show -g rg-files -n stfiles01 --query "protocolSettings.smb"

If the account only allows SMB 3.1.1 with AES-256-GCM and Kerberos, older clients (Windows Server 2012 R2, old kernels) fail. Upgrade the client, or relax the settings with security sign-off.

Tip

For persistent Linux mounts, add the entry to /etc/fstab with _netdev,nofail so boot doesn't hang when the network or share is unavailable.

Related fixes