Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to troubleshoot an obscure authentication error and need some background information.

Is there any difference between how Windows (and programs like Outlook) process DOMAIN\username and username@domain.local?

What are the proper terms for these two username formats?

Edit: In particular, are there any differences in how Windows authenticates the two username formats?

share|improve this question
    
You might be interested in one of my previous questions. –  Belmin Fernandez Mar 19 '12 at 16:43

3 Answers 3

up vote 10 down vote accepted

Assuming you have an Active Directory environment:

I believe the backslash format DOMAIN\USERNAME will search domain DOMAIN for a user object whose SAM Account Name is USERNAME.

The UPN format username@domain will search the forest for a user object whose User Principle Name is username@domain.

Now, NORMALLY a user account with a SAM Account Name of USERNAME has a UPN of USERNAME@DOMAIN, so either format should locate the same account, at least provided the AD is fully functional. If there are replication issues or you can't reach a global catalog, the backslash format might work in cases where the UPN format will fail. There may also be (abnormal) conditions under which the reverse applies - perhaps if no domain controllers can be reached for the target domain, for example.

However: you can also explicitly configure a user account to have a UPN whose username component is different from the SAM Account Name and whose domain component is different from the name of the domain.

The Account tab in Active Directory Users and Computers shows the UPN under the heading "User logon name" and the SAM Account Name under the heading "User logon name (pre-Windows 2000)". So if you are having trouble with particular users I would check that there aren't any discrepancies between these two values.

Note: it is possible that additional searches are done if the search I describe above doesn't find the user account. For example, perhaps the specified username is converted into the other format (in the obvious way) to see if that produces a match. There must also be some procedure for finding accounts in trusted domains that are not in the forest. I don't know where/whether the exact behaviour is documented.

Just to further complicate troubleshooting, Windows clients will by default cache information about successful interactive logons, so that you may be able to log into the same client even if your user account information in the Active Directory is inaccessible.

share|improve this answer
    
I like this answer better than mine. Nicely done. –  Ryan Ries Mar 20 '12 at 12:33

I may get corrected on this, but there's not really much of a difference.

Domain\User is the "old" logon format. Not sure if there's really a concise term for it. SAMAccountName or pre-Windows 2000 logon name doesn't seem to really encapsulate it.

User@Domain.com is a UPN - User Principal Name - It's the "preferred," newer logon format. UPNs are discussed in RFC 822. (try 2822.) The reasons for logging in with UPNs I think are mostly cosmetic - they hypothetically give your users in your company a single name with which to log on to their workstations which can also act as their corporate email address.

edit: More elaboration - another advantage of UPNs is that you can setup more than one valid UPN for your users to logon with. Again, largely cosmetic. But the important thing is that not all applications are compatible with UPNs, and that might be what you're experiencing.

edit #2: I like Harry Johnston's answer below about the two slightly different search formats performed. It makes sense, and most importantly it might actually explain your problem. :)

share|improve this answer
2  
There is no mention of UPNs in RFC 822, "Standard for the format of ARPA Internet text messages". UPNs are an Active Directory "invention" that binds together Kerberos and LDAP information in order to provide Single-Sign-On services (SSO) across a domain (or "realm") of associated computer systems. –  adaptr Mar 19 '12 at 14:46
    
Ah, sorry -- I was getting my info from msdn.microsoft.com/en-us/library/windows/desktop/… ... I'll edit my answer if I find the right one. –  Ryan Ries Mar 19 '12 at 16:28
1  
@adaptr RFC 822 was obsoleted 10 years ago - see rfc 2822. –  Jim B Mar 19 '12 at 16:55
    
@Ryan, I think the Active Directory is searched in different ways for the two different formats - see my answer. –  Harry Johnston Mar 20 '12 at 3:29
    
@JimB I think you'll find that no, RFC822 is NOT obsolete; both RFC2822 and the current RFC 5322 refer to it, as well as a multitude of other mail- and content-related RFCs (5321 for starters). –  adaptr Mar 20 '12 at 9:11

There is definelty a difference between those two only 99% of the users won't have a problem with it. I will try to explain the difference and when such a problem may occure.

If you use domain\username when you try to access a fileshare then DNS will first resolve the domain and then check the username. If you use username@domain then it will directly check if the user is on the ACL (access control list ) and has access. So what does it matter you might think... well, picture this:

1 domain controller with name DC01 and all the clients get dns and are in this domain. You want to migrate and someone added another server with the same name. The latter server will also become a DC so the local SAM won't be used anymore and also has a file share.

When the users will connect to the server they are prompted for credentials. If you use domain\username it will first check the current domain instead of using the new domain and we used accounts from the new domain on the file share. So once it has found the current dc and checks the username it can't be found. ( even if the username and password are found and are exact the same it won't work as it won't use the username to verify if it is allowed in the ACL but it will use the SID. The sid will be created at the user creation time in AD and you have a change of 1 in a trillion that it is the same, great huh:-P ).

share|improve this answer
    
-1. I really can't follow what you're saying here. Where you say "When the users will connect to the server" which server do you mean, the old DC01, or the new DC01? What happened to the old DC01 anyway, was it decommissioned, renamed, removed from the domain, or what? Was it properly demoted first? What do you mean by "new domain", since you didn't describe the creation of a new domain at any point? If you use "domain\username" it should always search the domain you explicitly specified, are you describing a case where it doesn't? –  Harry Johnston Jul 15 '13 at 22:07
    
Also, "it won't use the username to verify if it is allowed in the ACL but it will use the SID" is the expected behaviour - it should always do that, regardless of whether you use domain\username or username@domain. Are you talking about a case where there are two domains with the same name, or something similarly pathological? –  Harry Johnston Jul 15 '13 at 22:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.