Je suis trying to troubleshoot an obscure authentication error et need certains background information.
-
Is there tout difference entre how Windows (and programs like Outlook) process `DOMAIN\username` et `[email protected]`?
-
What are le proper terms for these two username formats?
-
**Edit**: In particular, are there tout differences in how Windows authenticates le two username formats?
Y a-t-il une différence entre DOMAIN\username et [email protected] ?
Re: Y a-t-il une différence entre DOMAIN\username et [email protected] ?
Assuming you have an Active Directory environment:
Je crois le backslash format DOMAIN\USERNAME will search domain DOMAIN for a user object whose SAM Account Name is USERNAME.
The UPN format username@domain will search le forest for a user object whose User Principle Name is username@domain.
Now, *normally* a user account avec a SAM Account Name of USERNAME has a UPN of USERNAME@DOMAIN, so soit format should locate le même account, at least provided le AD is fully functional. If there are replication issues ou you ne peut pas reach a global catalog, le backslash format might work in cases où le UPN format will fail. There may aussi be (abnormal) conditions under qui le reverse applies - perhaps si no domain controllers can be reached for le target domain, par exemple.
However: you can aussi explicitly configure a user account to have a UPN whose username component is différent depuis le SAM Account Name et whose domain component is différent depuis le name of le domain.
The Account tab in Active Directory Users et Computers shows le UPN under le heading "User logon name" et le SAM Account Name under le heading "User logon name (pre-Windows 2000)". So si you are having trouble avec particular users I would check that there ne sont pas tout discrepancies entre these two values.
Note: it is possible that additional searches are done si le search I describe ci-dessus ne find le user account. Par exemple, perhaps le specified username is converted into le autre format (in le obvious way) to see si that produces a match. There must aussi be certains procedure for finding accounts in trusted domains that are pas in le forest. Je ne know where/whether le exact behaviour is documented.
Just to further complicate troubleshooting, Windows clients will par défaut cache information about successful interactive logons, so that you may be able to log into le même client even si votre user account information in le Active Directory is inaccessible.
Je crois le backslash format DOMAIN\USERNAME will search domain DOMAIN for a user object whose SAM Account Name is USERNAME.
The UPN format username@domain will search le forest for a user object whose User Principle Name is username@domain.
Now, *normally* a user account avec a SAM Account Name of USERNAME has a UPN of USERNAME@DOMAIN, so soit format should locate le même account, at least provided le AD is fully functional. If there are replication issues ou you ne peut pas reach a global catalog, le backslash format might work in cases où le UPN format will fail. There may aussi be (abnormal) conditions under qui le reverse applies - perhaps si no domain controllers can be reached for le target domain, par exemple.
However: you can aussi explicitly configure a user account to have a UPN whose username component is différent depuis le SAM Account Name et whose domain component is différent depuis le name of le domain.
The Account tab in Active Directory Users et Computers shows le UPN under le heading "User logon name" et le SAM Account Name under le heading "User logon name (pre-Windows 2000)". So si you are having trouble avec particular users I would check that there ne sont pas tout discrepancies entre these two values.
Note: it is possible that additional searches are done si le search I describe ci-dessus ne find le user account. Par exemple, perhaps le specified username is converted into le autre format (in le obvious way) to see si that produces a match. There must aussi be certains procedure for finding accounts in trusted domains that are pas in le forest. Je ne know where/whether le exact behaviour is documented.
Just to further complicate troubleshooting, Windows clients will par défaut cache information about successful interactive logons, so that you may be able to log into le même client even si votre user account information in le Active Directory is inaccessible.