Ok, so the keytab file got creating using your suggested command. Here was the output:
~~~
Targeting domain controller: DC01.domain.local
Using legacy password setting method
Successfully mapped xmpp/lfnopenfire.domain.local to xmpp-openfire.
Type the password for xmpp/lfnopenfire.domain.local:
Type the password again to confirm:
Key created.
Output keytab to c:\xmpp.keytab:
Keytab version: 0x502
keysize 77 xmpp/lfnopenfire.domain.local@DOMAIN.LOCAL ptype 1 (KRB5_NT_P
RINCIPAL) vno 6 etype 0x3 (DES-CBC-MD5) keylength 8 (0x40f7b32908fe8670)
Account xmpp-openfire has been set for DES-only encryption.
~~~
ktutil output:
1 6 xmpp/lfnopenfire.domain.local@DOMAIN.LOCAL
Unfortunately I seem to be getting the same behavior / error. I will keep playing with it and let you know if anything changes.