Generating Keytabs
From SambaWiki
Active directory requires kerberos service principle names to be mapped to a user account before a keytab can be generated.
you can add spn names using the samba-tool provided with your samba 4 installation.
samba-tool spn add host/fdqn@KerberosRealm sAMAccount
this should return without error.