**Available in Beta for CAPTOR Android Enterprise, CAPTOR for Intune (Android), and CAPTOR for BlackBerry (Android) starting with versions 3.2.6.***
When Auth Type is set to Kerberos, CAPTOR authenticates to the file server using the customer's Active Directory credentials via the domain controller, rather than sending the password to the file server directly. This is the standard authentication method in a modern AD environment and continues to work in hardened networks where NTLM has been disabled. Note that Kerberos still uses the same Username and Password fields shown above the Auth Type selector — those are the AD account credentials, and they are required. Kerberos does not remove the need for the user's login; it uses that login to obtain a ticket from the domain controller.
For a Kerberos configuration, all of the following are required: Username, Password, Kerberos Realm, KDC Host, Host, Share, and Path. If any of these is empty, the backup configuration is treated as incomplete and will not run.
Username
The bare Active Directory account name (the samAccountName), for example alice. It must not be a full User Principal Name — do not include an @realm suffix such as alice@SMBTEST.INTERNAL. The realm is taken from the separate Kerberos Realm field, not from the username. A value containing @ will be rejected.
Kerberos Realm
The Active Directory domain the user belongs to, for example SMBTEST.INTERNAL or CORP.EXAMPLE.COM. This is normally the customer's AD domain name in upper case. The app automatically converts whatever is entered to upper case and trims surrounding whitespace, so either case is accepted on input, but it is stored and used in upper case. It must not be blank.
KDC Host
The address of the domain controller that issues Kerberos tickets, entered as either host or host:port. If no port is given, port 88 (the standard Kerberos port) is used automatically. For example, dc1.smbtest.internal and dc1.smbtest.internal:88 are equivalent. A fully-qualified hostname is recommended, but because this value is used only as a network address to reach the KDC (not as part of the Kerberos service name), an IP address is also acceptable here if DNS is not available for the domain controller. It must not be empty.
Host
The fully-qualified hostname of the SMB file server, for example fileserver.corp.example.com. For Kerberos this field has a strict restriction: it must be a fully-qualified hostname and cannot be an IP address. This is because Kerberos ties authentication to the server's registered name (the service principal is derived from this host as cifs/<host>), and a raw IP literal — IPv4 like 192.168.1.10 or IPv6 — will be rejected. The server's FQDN must resolve on the device, which is normally handled by the customer's VPN or network configuration. In many single-server deployments the KDC Host and the file server Host are the same machine and will have the same value.
Share
The name of the SMB share on the file server, for example Backups or testshare. This is the share name only, without slashes or a server prefix. It must not be empty.
Path
The directory path within the share where media is written, relative to the share root, for example captor-test or backups/captor. Leading and trailing slashes are ignored. The app creates per-folder subdirectories under this path as needed. It must not be empty.
Variable support ($USERID$, $EMAIL$, $PASSWORD$)
Variable substitution is supported, but only for values delivered through managed configuration (MDM), not for values typed directly into the on-device settings screen.
When a field is pushed via managed config, the tokens $USERID$, $EMAIL$, and $PASSWORD$ are replaced with the signed-in CAPTOR user's username, email, and password respectively. This applies to the Kerberos keys as well, so smbrealm, smbkdc, smbhost, smbpath, smbshare, smbuser, and smbpassword all accept these tokens when set through MDM. If a user instead types a value like $USERID$ into the app's settings UI by hand, it is stored literally and not substituted. In practice, variables are most useful in Path and Username (which vary per user), whereas Kerberos Realm, KDC Host, and Host are typically the same for everyone in the domain and are entered as fixed values.
Example (test data)
Auth Type: Kerberos
Username: alice
Password: Passw0rd-Test-1
Kerberos Realm: SMBTEST.INTERNAL
KDC Host: dc1.smbtest.internal
Host: dc1.smbtest.internal
Share: testshare
Path: captor-test
Device Clock Note
Kerberos is time-sensitive and rejects a badly-skewed clock (the tolerance is five minutes). The device should use automatic network time. A wrong device clock is the single most common cause of a Kerberos failure that otherwise looks like a credentials problem.