29

A coworker just demonstrated to me that accounts in our test AD was able to authenticate when replacing every a character in their samAccountName with Danish character å (ASCII 134 / å).

E.g. the user <domain>\aaa can authenticate as ååå.

I tried reproducing this in a freshly provisioned W2K12R2 AD (single server, all standard values), and it works there too. I created an account aaa (never touching the letter å in the process, so that nothing contains å) and ran:

PS C:\Users\Administrator> runas /user:ååå notepad
Enter the password for ååå:
Attempting to start notepad as user "DEV-DLI\ååå" ...
PS C:\Users\Administrator>

which caused notepad to start, running as aaa.

The same seems to hold true for o and Danish character ø, while the last Danish special char æ does not seem to correspond to any other character. With user aaa in AD, trying to create a user with samAccountName ååå will fail, informing you that The user logon name you have chosen is already in use (...).

I have googled like a madman, but have been unable to find out what is going on. Does anyone have any hints as to why this works?

Improve this question
5
  • 5
    The character æ should correspond to ae (the letter a followed by the letter e), FWIW.
    – HopelessN00b
    Commented Jan 23, 2015 at 13:17
  • 4
    The character å does not exist in ASCII.
    – TRiG
    Commented Jan 23, 2015 at 16:17
  • 1
    Yep. Nitpick, but there is no such thing as "ASCII 134", because ASCII only goes up to 127.
    – hobbs
    Commented Jan 23, 2015 at 19:21
  • 1
    According to man ascii: ASCII is the American Standard Code for Information Interchange. It is a 7-bit code. Many 8-bit codes (e.g., ISO 8859-1) contain ASCII as their lower half. The international counterpart of ASCII is known as ISO 646-IRV. It looks like å is ISO 8859-1 #229 and ø is ISO 8859-1 #248.
    – jayhendren
    Commented Jan 23, 2015 at 19:59
  • 2
    As a native Danish speaker, I can tell you that it doesn't make sense to me either. There is no ASCII substitute for the letters æ and ø. There are some frequently used substitutes, but they are not valid spellings, and in some cases produce an entirely different word. In the case of å, it was added to the alphabet less than a century ago, and using the old spelling doesn't introduce any ambiguity. However the old spelling would be to use aa instead of å. Substituting a single a for the letter å is not a correct spelling.
    – kasperd
    Commented Jan 23, 2015 at 23:45

2 Answers 2

Reset to default
32

This is by design. In short, Active Directory maps the accented/diacritical characters to their "simple" form. Please see the following Microsoft Support article.

Windows logon behavior if your user name contains characters that have accents or other diacritical marks (Dead link) (Live version archived here):

If your user name in the Active Directory directory service contains one or more characters that have accents or other diacritical marks, you may find that you do not have to use the diacritical mark as you type your user name to log on to Windows. You can log on by using the simple form of the character or characters. For example, if your user name in Active Directory is jésush, you can type jesush in the User name box in the Log On to Windows dialog box to log on to Windows.

This behavior occurs so that in situations when you have to log on to Windows from a computer where the preferred keyboard mapping is not installed, you can still log on to Windows by using your user name without the diacritical marks.

Improve this answer
8
  • 13
    I'm not a fan of Microsoft, but in that case I'm really impressed that the US company have seen the problems with keyboard inputs as the real issue and adress it in such quite an elegant way.
    – user67107
    Commented Jan 23, 2015 at 13:44
  • 20
    @РСТȢѸФХѾЦЧШЩЪЫЬѢѤЮѦѪѨѬѠѺѮѰѲѴ Best combination of username and comment I've yet to see on here, by the way.
    – HopelessN00b
    Commented Jan 23, 2015 at 13:47
  • 2
    One wonders what kind of security holes they might have left behind by doing this :)
    – hobbs
    Commented Jan 23, 2015 at 19:23
  • 5
    Actually those are not diacritical marks, they are entirely separate letters. Calling ø an o with a diacritical mark makes as much sense as calling q an o with a diacritical mark. In reality o, q, and ø are three different letters, it just happens that two of them are in ASCII and one of them is not. Being in ASCII or not is not part of the definition of a diacritical mark. But being in ASCII or not can make a difference in how easy it is to log in.
    – kasperd
    Commented Jan 23, 2015 at 23:57
  • 7
    @kasperd This is also language dependent; in Swedish, 'ä' is its own letter, in german it's an 'a' with an umlaut as its diacritical mark.
    – beerbajay
    Commented Jan 24, 2015 at 19:12
17

This is the result of "Collation"

In addition to @jscott's reference (+1) and slightly too long for a comment:
something similar is done with the case, as although the username is stored in the correct case, you can log on with a username in all small, upper and even mixed case. HBruijn = hbruijn = HbRuIjN, AD is case aware but not case-sensitive in some of the fields.

The correct term (in IT most often seen in database configuration) is Collation and is what governs ordering, matching and canonical equivalence. Collation rules typically also depend on the locale.

Of interest may be

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .