Recipe 6.32 Creating a UPN Suffix for a Forest

6.32.1 Problem

You want users to have a different User Principal Name (UPN) suffix from the default provided by your forest.

6.32.2 Solution

6.32.2.1 Using a graphical user interface

1. Open the Active Directory Domains and Trusts snap-in.

2. In the left pane, right-click Active Directory Domains and Trusts and select Properties.

3. Under Alternate UPN suffixes, type the name of the suffix you want to add.

4. Click Add and OK.

6.32.2.2 Using VBScript

' This code adds a new UPN suffix. ' ------ SCRIPT CONFIGURATION ------ strNewSuffix = "<NewSuffix>"   ' e.g. othercorp.com strDomain = "<DomainDNSName>"  ' e.g. rallencorp.com ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE") set objPartitions = GetObject("LDAP://cn=Partitions," & _                               objRootDSE.Get("ConfigurationNamingContext")) objPartitions.PutEx ADS_PROPERTY_APPEND, "uPNSuffixes", Array(strNewSuffix) objPartitions.SetInfo

6.32.3 Discussion

The UPN allows users to log on with a friendly name that may even correspond to their email address. UPN logons also do not require the domain to be known so that it can be abstracted away from the user. You may need to create an additional UPN suffix (e.g., @rallencorp.com) if you want UPNs to map to email addresses, but your AD forest is rooted at a different domain name (e.g., ad.rallencorp.com) than the domain name used in email addresses (e.g., rallencorp.com).

6.32.3.1 Using VBScript

UPN suffixes are stored in the multivalued uPNSuffixes attribute on the Partitions container in the configuration-naming context. The default forest UPN suffix is assumed and not stored in that attribute.

6.32.4 See Also

MS KB 243280 (Users Can Log On Using User Name or User Principal Name), MS KB 243629 (HOW TO: Add UPN Suffixes to a Forest), and MS KB 269441 (HOWTO: Use ADSI to List the UPN Suffixes That Are Defined in Active Directory)