0

Since Windows 2000 NTLM has been replaced with Kerberos. Thus Kerberos uses UPNs to identify the users. UPN is also the preferred usernaming format.

Now, why does Windows 7 still display a logged in AD user by default as DOMAIN\USER instead of USER@REALM? This happens only when I explicitly log in with the UPN. Same happens in SharePoint, file properties dialog and so forth. I presume that this is done by SSPI automatically.

I know that AD internally works with SIDs but Kerberos does not. At least my GSS-API does not provide access to the PAC, I solely rely on the implicit UPN which is of course not findable through LDAP. (Note the attribute userPrincipalName can be reset to any arbitrary value like the explicit UPN (enterprise principal).

Edit: here is another good reason why this crap is still around. Hopefully, this legacy will be gone with Windows 9. Windows NT 4 is dead, fortunately. And another one finally deprecated. So, someday Windows should show Kerberos realms in the domain logon dropdown box instead of NetBIOS names.

Improve this question

1 Answer 1

Reset to default
4

NetBIOS Usernames (domain\user format) have been superseded by Kerberos Usernames, but not replaced. However, these are used for Authentication. For Access, the LDAP Distinguished Name is used in AD Environments.

As for Why Win7 still displays NetBIOS by default and not UPN; you'd have to ask MS, but I suspect it was the same reasonsing as many of their quirky decisions: Some manager freaked out that something on his/her screen changed, so he insisted it be changed back to what s/he's used to.

Improve this answer
6
  • 1
    I support many, many Windows users. I would guess the similarity of the format "username@REALM" and the format of an email address may be confusing for those users. You will note I am mealy speculating. :)
    – jscott
    Dec 10, 2012 at 15:40
  • 1
    @jscott That could be very true, especially if your organization picked a crazy scheme where the UPN is different from the users e-mail address (where I work) and there is always great confusion anytime a user sees a UPN. OTOH, if they were the same it would likely be simpler for the user if you told them to login with their e-mail address....
    – Chris S
    Dec 10, 2012 at 15:45
  • Another Windows quirk. Not very consistent from Microsoft. Why is NetBIOS still there. Hasn't it been completely replaced by DNS and other techniques?
    – Michael-O
    Dec 10, 2012 at 16:16
  • @ChrisS, it's not. You can configure an enterprse principal which is the email address. This is implemented by KDC referrals. You account can be moved from one realm to another by your enterprise principal remains the same. See UPN suffixes for this.
    – Michael-O
    Dec 10, 2012 at 16:17
  • Many companies do not show last logon and may be a really long username to type if you have to type the full realm name as well.
    – Bad Dos
    Dec 10, 2012 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .