3

I've been tasked with a domain wide UPN & SAMaccountName change. We're going from [email protected] to [email protected]

I've got a script to do so but I'm hesitant to do it to any non test users because of the possible impact for users. Have any of you undergone something different? I'm looking for best practice tips but not having much luck. I can think of probably 5 non-IT-managed services which have an LDAP connection or some sort of AD integration which I don't know how will react.

Any advice is welcome as I'm trying to make this as smooth as possible for end users. Even if you think it's a stupid idea ha ha.

2
  • At least you have some idea of how dumb this is. I'm sorry for your troubles. I've never seen this type of change go well.
    – Jim B
    Jul 6, 2016 at 9:20
  • How many user accounts are in scope?
    – Greg Askew
    Jul 6, 2016 at 16:21

2 Answers 2

1

With something like this, the absolute bare minimum you would want to do is set up several accounts and create profiles and mailboxes, etc. for them and then run the script just on those users and see what happens. Aside from technical challenges you'll want to look for how the user experience is affected.

If you have services for which you don't know what will happen when you do this, you need to test those services specifically. Make a test user, change the username, go through everything to see what breaks. Find out how to make it not break or how to fix it right away so you know what you have to do so things keep working when you do this to a real user.

If you change a username (the word I will use for short to include both the SAM account name and UPN) for a Windows user while they are logged on, I'm pretty sure their security tokens become instantly invalid and all kinds of unexpected behavior can occur. If you haven't done this before, you should definitely go through the process of just changing a single username for a user so you see what happens.

This is the kind of thing that has to be done from time to time when people change names due to marriage, so it's doable. I think the challenge will be trying to do it for everyone all at once.

1
  • Thanks for advice Todd, I've done up a spreadsheet for what I need to check on my test users. Luckily I'm planning to do it gradually, 5 or less users at a time so I can assist with whatever issues arise.
    – spkvn
    Jul 6, 2016 at 22:49
1

I'm not sure if this is still an issue, but from experience changing the samAccountname/mailNickname can wreak havoc with Outlook. This may cause breakage with replies to old emails and meeting requests. Also the Outlook "Quick Pick" or nicknames may not be updated, so be prepared to field a lot of calls for that.

1
  • I'll keep an eye out for this on my test users. Thanks.
    – spkvn
    Jul 6, 2016 at 22:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .