8

I've changed the for all users UPN suffix of a company from us.mycompany.local to mycompany.com in order to use claims-aware applications. In testing before the change I discovered that even if I changed the UPN suffix, a user could successfully authenticate using the old suffix. What I don't understand is why this still works.

4
  • Did you try this on a fresh machine? I assume you're probably just seeing cached logons.
    – MDMarra
    Commented Apr 4, 2013 at 15:10
  • 1
    I'm a little confused on what you're asking. You can add alternate UPN suffixes, but you can't remove the default of [email protected], where my.domain.com is the actual DNS name of the domain to which the user belongs. Is that what you're trying to do?
    – Ryan Ries
    Commented Apr 4, 2013 at 15:16
  • 1
    I just tested and I was able to log on with both the implicit UPN and the explicit UPN, which is probably by design. My guess is that you can always log on with the implicit UPN and only one explicit UPN, if multiple explicit UPN's are defined.
    – joeqwerty
    Commented Apr 4, 2013 at 15:41
  • as an update another way this now works is with adfs 2012 alternate login credentials feature
    – Jim B
    Commented Aug 28, 2014 at 18:02

2 Answers 2

13

Ryan and Joe's comments above are on target. It sounds like your users are logging in with their Implicit UPNs. Is your domain's FQDN us.mycompany.local?

In Active Directory, each user has two UPN's:

  1. Explicit UPN (eUPN): This is the value of the user object's userPrincipalName attribute. This can be changed to any value, regardless of any alternate UPN suffixes you have configured in the forest.

  2. Implicit UPN (iUPN): This is constructed by concatenating the value of the user object's samAccountName attribute with the value of the domain's FQDN. The FQDN is stored as the value of the dnsRoot attribute of the domain's crossRef object stored at LDAP://CN=DOMAIN_NETBIOS_NAME,CN=Partitions,CN=Configuration,DC=DOMAIN)

Jorge de Almeida Pinto, a DS MVP, has a series of posts that go into much more detail:

EDIT 1:

It's also worth noting that the eUPN "wins" if there is a conflict. For example, consider the following (albeit ridiculous) scenario:

  • Domain name: example.com
  • User1's samAccountName: user1
  • User2's userPrincipalName (eUPN): [email protected]

If you attempt to login using the username [email protected], you will be logged in as User2. However, if you change User2's userPrincipalName to anything else, you would be signed in as User1.

EDIT 2:

More info per MS: MSKB929272: Interactive logon styles and Key Distribution Center account lookup in Windows Server 2003

2
  • Great answer, and the links provide great specifics- nicely done.
    – Jim B
    Commented Apr 12, 2013 at 4:05
  • Richard Mueller (MVP Directory Services) touched on this in this TechNet Answer: 2015-04-06, Two account with same UPN in Active Directory. (Archived here.) -- He uses the term >>"default" UPN<< instead of implict UPN/iUPN. (The double quotes are in the original post as well.) Commented Dec 20, 2018 at 8:43
0

It could be one of two things:

  1. The new UPN is added as an alternative UPN, and the original still stands.
  2. The old UPN is added as Domain name (pre-Windows 2000), and will be functional

Go to Active Directory Domains and Trusts and check the UPN(s) and the pre-windows setting.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .