A coworker just demonstrated to me that accounts in our test AD was able to authenticate when replacing every a character in their samAccountName with Danish character å (ASCII 134 / å).
E.g. the user
<domain>\aaa can authenticate as
I tried reproducing this in a freshly provisioned W2K12R2 AD (single server, all standard values), and it works there too. I created an account
aaa (never touching the letter å in the process, so that nothing contains
å) and ran:
PS C:\Users\Administrator> runas /user:ååå notepad
Enter the password for ååå:
Attempting to start notepad as user "DEV-DLI\ååå" ...
which caused notepad to start, running as
The same seems to hold true for o and Danish character ø, while the last Danish special char æ does not seem to correspond to any other character. With user
aaa in AD, trying to create a user with samAccountName
ååå will fail, informing you that
The user logon name you have chosen is already in use (...).
I have googled like a madman, but have been unable to find out what is going on. Does anyone have any hints as to why this works?