ktpass /princ host/atsserver.users.myserver.com@MYSERVER.COM -pass atsserver_password -mapuser atsserver -out atsserver.keytab -mapOp set -ptype KRB5_NT_PRINCIPAL"
For me the above didn't work, the below did.

ktpass /princ <active directory user>/<active directory user containers>.<active directory domain>@< Uppercase of active directory domain> -pass <active directory user's password> -mapuser <active directory user> -out <active directory user>.keytab -mapOp set -ptype KRB5_NT_PRINCIPALs"

Real example:
ktpass /princ zcmkerbuser/users.appzcm.domain.com@DOMAIN.COM -pass zcmkerbuserPassword -mapuser zcmkerbuser -out zcmkerbuser.keytab -mapOp set ptype

Although I have a dns domain name (company.com) different from the active directory (adcompany.com), and the Linuxs ZCM servers are only registered on the dns domain name (forward and reverse), the command above still worked.
I recommend creating a new user, run this command, import keytab, create user source, test. Using "an old user" or moving the user in the Active Directory doesnt work.