0

This works:

New-ADServiceAccount 1234567890123456789

This doesn't:

New-ADServiceAccount 12345678901234567890

New-ADServiceAccount : The name provided is not a properly formed account name

I'm trying to replace IIS Application Pool Identities with domain users so I can set directory permissions on a file server. These virtual users take the name of the application pool, which I normally set to the domain for the site, e.g. com.example.www
The length of the domain can easily exceed 19 characters. Is there a way to get past this limit?

Improve this question

1 Answer 1

Reset to default
1

Try -SamAccountName

From New-ADServiceAccount

SamAccountName

Specifies the Security Account Manager (SAM) account name of the user, group, computer, or service account. The maximum length of the description is 256 characters. To be compatible with older operating systems, create a SAM account name that is 20 characters or less. This parameter sets the SAMAccountName for an account object. The LDAP display name (ldapDisplayName) for this property is "sAMAccountName".

The following example shows how to specify this parameter.

-SAMAccountName "saradavis"
Improve this answer
3
  • I had come across this SAM name limit but since it's 20 characters I didn't look into it any further. I guess the 20th character is the $ being appended?
    – Stijn
    Apr 1, 2014 at 8:25
  • Yes, the $ counts as a character as well.
    – MichelZ
    Apr 1, 2014 at 8:31
  • There appear to be additional length limitations. I've posted my findings on serverfault.com/questions/585901/…
    – Stijn
    Apr 1, 2014 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .