Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Is there a way to set the default UPN suffix for creating new users an Active Directory?

For example, if I have corp.mydomain.com as my AD domain, and I've added an alternate UPN suffix under Domains and Trusts that is just mydomain.com, is there any way to have that domain be the default when creating new users?

I know I can just create a template user and then when I copy it, it will have the right default suffix, but just curious as to whether there was a hidden setting that would control this.

share|improve this question

4 Answers 4

up vote 5 down vote accepted

There is no documented mechanism that I am aware of to change the default UPN suffix that gets chosen by Active Directory Users and Computers. I believe that the tool is hard-wired to take the first portion of the "canonicalName" attribute defined on the "crossRef" object for the domain specified in "CN=Partitions,CN=Configuration, ..." in your forest.

AD Users and Computers just happens to be hard-wired to do this. If you create user accounts using other means ("NET USER ... /add", for example) then no userPrincipalName attribute will be assigned to the account. The default UPN suffix is really just a default in AD Users and Computers, not a default of the directory service itself.

Should you run into the Microsoft KB article with a script in it that shows you how to programmatically obtain the default UPN suffix (http://support.microsoft.com/default.aspx?scid=kb;en-us;Q269441), beware that the script has a couple of syntax errors in it (lines 17 and 32 are malformed and srrNamingContext on line 32 should be strNamingContext). I'll include a fixed version with a minor improvement at the end of this post (it shows you the names of individual OUs where additional UPN suffixes might be defined).

I'd love to be corrected by somebody more "in the know" than me, but I'm not seeing any way to get AD Users and Computers to act differently.

' --- Get the naming contexts ----
Set RootDSE = GetObject("LDAP://RootDSE")
strNamingContext = RootDSE.Get("defaultNamingContext")
strConfigContext = RootDSE.Get("configurationNamingContext")

' -- Get the current domain name --
Set oDomain = GetObject("LDAP://" + strNamingContext)
strDomainName = oDomain.Get("name")

Set oPartition = GetObject("LDAP://CN=Partitions," & strConfigContext)

'-- Get the DNS name of the domain --
oDomain.GetInfoEx Array("canonicalName"), 0
strCanonical = oDomain.Get("canonicalName")
strDNSName = Left(strCanonical, Len(strCanonical) - 1) 'clip off "/"

'-- Display the default UPN suffix
wscript.echo strDNSName

'-- Get the defined upnSuffixes --
suffixes = oPartition.GetEx("UPNSuffixes")
For Each upnSuffix In suffixes
  wscript.echo upnSuffix
Set RootDSE = Nothing
Set oDomain =Nothing
Set oPartition = Nothing

' -- Get the upnsuffixes defined on organizational units --
Set ADOconn = CreateObject("ADODB.Connection")
Set ADOcom = CreateObject("ADODB.Command")

ADOconn.Provider = "ADsDSOObject"
bstrADOQueryString = "<LDAP://" + strNamingContext + ">;(objectcategory=organizationalUnit);upnsuffixes,ADsPath;subtree"
wscript.echo bstrADOQueryString 
ADOcom.ActiveConnection = ADOconn

ADOcom.CommandText = bstrADOQueryString
ADOcom.Properties("Page Size") = 99

Set objRS = ADOcom.Execute

While Not objRS.EOF
   If Not IsNull(objRS.Fields("upnSuffixes")) Then
    upnsuffixes = objRS.Fields("upnSuffixes")
    For Each upnsuffix In upnsuffixes
        wscript.echo objRS.Fields("adsPath") & " - Suffix: " & upnsuffix
   End If


Set objRS = Nothing
Set ADOcom = Nothing
Set ADOconn = Nothing
share|improve this answer
I was hoping there was some registry entry or something. I'll mark this as correct if no one else chimes in with anything in the next 24h. –  Adam Brand Jul 26 '09 at 15:45
In our case we run a daily script which checks UPN of each user and if they don't have standard naming, it changes them to standard. This script looks at many attributes and corrects them if required. –  KAPes Aug 10 '09 at 2:23
@KAPes: That's a neat idea. At sites where multiple delegated AD administrators create user accounts I've normally deployed scripts to do most of the provisioning chores. Still, I could see scripting up some LDAP queries to generate "Hey, dummy-- you provisioned this wrong!" emails (or, obviously, to fix things automatically when the computer has enough information to do it automatically). –  Evan Anderson Aug 10 '09 at 2:44
Evan's answer is still correct. Some have also suggested setting the uPNSuffixes attribute on the OU. This will simply override the list uPNSuffixes set on the domain but will still default to the canonicalName of the domain. –  charleswj81 Oct 15 '13 at 16:01

This can't be done as far as I know (Evan's answer is still true 4 years later).

That said, I've written a script that runs in task scheduler every few hours at more than one client. It searches for a specific suffix (the default in most cases) and switches it to another. The script is on my blog but I'll post it here as well :)

Import-Module ActiveDirectory

Get-ADUser -Filter {UserPrincipalName -like "*@ad.example.com"} -SearchBase "OU=SomeUserOu,DC=ad,DC=example,DC=com" |
ForEach-Object {
    $UPN = $_.UserPrincipalName.Replace("ad.example.com","example.com")
    Set-ADUser $_ -UserPrincipalName $UPN

In this case, users created with an ad.example.com UPN suffix will be updated with example.com suffix.

share|improve this answer
I got to thinking about using AD change notifications to do this kind of thing in realtime but that would be silly overkill. –  Evan Anderson Oct 15 '13 at 16:38
UPN is becoming more and more important with O365 and dirsync requirements for ADFS SSO. You'd think there'd be something baked in by now :) –  MDMarra Oct 15 '13 at 16:44
Sometimes I think I'm the only person actually using Microsoft's products. >smile< I'm getting ready to do my first Office365 implementation in the next couple of weeks (complete w/ hybrid on-site/off-site Exchange) so I'll get to experience all of that ADFS SSO and DirSync fun soon enough. –  Evan Anderson Oct 15 '13 at 17:31
I don't do O365 directly (we have a couple collab guys on staff), but I've done some Intune work which uses the same Azure tenant AD. I hope your first ride is smoother than mine was :) –  MDMarra Oct 15 '13 at 17:47

Actually, you can run in the Active Directory Module for Powershell: Set-ADOrganizationalUnit "OU=XXX,DC=Domain,DC=com" -Add @{upnsuffixes="@UPNSuffix.com".

Or you could use a "Get-adorganizationalUnit" with a -Filter switch and pipe that to a 'Set-ADOrganizationalUnit -Add @{upnsuffixes="@UPNSuffix.com"'

I found this after looking for quite a while, so I hope this helps anyone.

share|improve this answer
The question is about setting the default suffix for adding new users, not adding a upn suffix. –  austinian Aug 18 at 17:17

This technet article describes how to add or remove UPN suffixes in your domain:


There's also a discussion of it here:


I can't vouch for it personally as I've never had to do this, but one thing does spring to mind. If you're going to do this you'll need to bear in mind that while AD will work correctly, the same might not be the case for any 3rd party software you have, which may assume that the UPN suffix is always the standard one. Consider the consequences carefully before making the change, in other words.

share|improve this answer
Yes, I know how to add UPN suffixes. My question was on setting the default suffix for adding new users. –  Adam Brand Jul 26 '09 at 17:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.