Logon name > 20 characters

bearlyworking · Guest

Does windows support logon names longer than 20 characters?

I am unable to logon with a greater than 20 character username.

We are running a win2k3 native domain with 2k and XP clients.

We are planning on changing our naming convention (due to an extra 35k
accounts)

thanks
BW

Richard Mueller [MVP] · Guest

The entire area of names is very confusing in AD. When you create a user
with the GUI in ADUC:

1. You enter first name, middle initial, and last name. These become the
values of the "givenName", "initials", and "sn" attributes of the user
object.
2. The GUI fills in the "Full name" field, although you can alter it. This
is the "cn" attribute (Common Name). It also becomes the "Display Name" in
ADUC, which is the value of the "displayName" attribute.
3. You fill in a field labeled "User logon name". This is the
"userPrincipalName" (with the suffix in the next box in the form
@MyDomain.com).
4. The GUI fills in the "pre-Windows 2000" name, which is the
"sAMAccountName" attribute.

In ADUC the field labeled "Name" is the Common Name of the user (the value
of the "cn" attribute).

Although the sAMAccountName is limited to 20 characters, the
userPrincipalName and cn attributes can be over 100 characters. You can
logon with either userPrincipalName or sAMAccountName. If you key in a value
over 20 characters for userPrincipalName in the GUI when you create the
user, the sAMAccountName value is cut off after the first 20 characters. You
can also modify these values in ADUC after the user is created, on the
Account Tab. The userPrincipalName is labeled "User logon name" and
sAMAccountName is labeled "User logon name (pre-Windows 2000)".

sAMAccountName and userPrincipalName each must be unique in the domain. The
Common Name must be unique in the container or OU.

--
Richard Mueller
Microsoft MVP Scripting and ADSI
Hilltop Lab - http://www.rlmueller.net
--

"bearlyworking" <bearlyworking@discussions.microsoft.com> wrote in message
news:CFE2B171-01C7-4F2C-8222-F22011D8FE4A@microsoft.com...

Richard Mueller [MVP] · Guest

BW wrote:

Lanwench [MVP - Exchange] · Guest

bearlyworking <bearlyworking@discussions.microsoft.com> wrote:

bearlyworking · Guest

So the samaccount name is the name a user types in on their win2k\xp user
logon screen,correct?

In ADUC when you create an account there is 2 fields for logon name.
User logon name and then the pre-2k logon name.
So are both fields limited to 20?
If user logon name is not limited to 20 can we use that to logon with?

We are using clients 2000 SP4 and newer so we don't need to use the pre-2k
name.

WRT to the naming change.
A commitee (with no techs on it..typical) decided to change the naming
convention to firstname_lastname to fit a new portal software implemention.

Thanks a bunch for the replies.
BW

"Richard Mueller [MVP]" wrote: