7

I have an AD user without special characters (Š = S with caron), for example myspecialuser. Why can I log in to windows using special characters in the username, myšpecialuser for example, even when it does not exist? How can I disable this behaviour?

  • Does it work with your UPN or just the SamAccountName? I suspect it to be a "legacy thing" – Mathias R. Jessen Oct 25 '13 at 9:36
  • @MathiasR.Jessen: it works with both, UPN and SamAccountName – redman Oct 25 '13 at 9:41
9

Microsoft did this on purpose. See this article: Microsoft diacritic mark

I also found this which answers your question directly, no you can't disable the behaviour.

Recently someone asked:

Can anyone point me to the document with list of allowed characters for AD username (W2K and W2K3)? I am also looking for document which describes behavior that some characters are replaced during logon process. Example: If my username is ddomjanovic I am also able to login with username ddomjanović. So it looks like ć (codepage 1250, E6 = U+0107 : LATIN SMALL LETTER C WITH ACUTE) is replaced with c (63 = U+0063 : LATIN SMALL LETTER C) during logon process.

Can this behavior be disabled?

I sort of answered that question in this post, but in a roundabout way. The short answer is No, there is no way to disable that behavior. The reason is that Active Directory passes the following flags:

NORM_IGNORECASE | NORM_IGNORENONSPACE | NORM_IGNOREWIDTH | NORM_IGNOREKANA

which means that there are many distinctions like this that are folded together.

Now as that other post stated, local accounts do not work through AD, so they take a more literal stand on things. You know, that whole "UpCase and Binary" thing that not only consider c (U+0063) and ć (U+0107) to be different letters, but which also considers ć (U+0107) and ć (U+0063 U+0301) to be different ones, too. Since the latter pair looks alike, it is obviously a solution that to a lot of people will be worse than the original problem!

Taken from: Sorting it all out

| improve this answer | |
2

I'm not sure you can. I have seen the same, but going the other way. The account was using a "special" character in its username, but the user could log using the "normalized" form of the user name.

One other strange thing we saw, was that on a disconnected computer (using cached credentials), the user name must be typed correctly, e.g. "normalization" only works when connected to the domain.

Sorry for not having a solution for you.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.