A bulk-enrolled host does not get a kerberos service principal until enrollment time.
In order for this to work against a v1 database the update host.update needs to be applied