This works:

New-ADServiceAccount 1234567890123456789

This doesn't:

New-ADServiceAccount 12345678901234567890

New-ADServiceAccount : The name provided is not a properly formed account name

I'm trying to replace IIS Application Pool Identities with domain users so I can set directory permissions on a file server. These virtual users take the name of the application pool, which I normally set to the domain for the site, e.g. com.example.www
The length of the domain can easily exceed 19 characters. Is there a way to get past this limit?


Try -SamAccountName

From New-ADServiceAccount


Specifies the Security Account Manager (SAM) account name of the user, group, computer, or service account. The maximum length of the description is 256 characters. To be compatible with older operating systems, create a SAM account name that is 20 characters or less. This parameter sets the SAMAccountName for an account object. The LDAP display name (ldapDisplayName) for this property is "sAMAccountName".

The following example shows how to specify this parameter.

-SAMAccountName "saradavis"
  • I had come across this SAM name limit but since it's 20 characters I didn't look into it any further. I guess the 20th character is the $ being appended? – Stijn Apr 1 '14 at 8:25
  • Yes, the $ counts as a character as well. – MichelZ Apr 1 '14 at 8:31
  • There appear to be additional length limitations. I've posted my findings on serverfault.com/questions/585901/… – Stijn Apr 1 '14 at 13:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.