6.32. Creating a UPN Suffix for a Forest
Problem
You want users to have a different User Principal Name (UPN) suffix from the default provided by your forest.
Solution
Using a graphical user interface
Open the Active Directory Domains and Trusts snap-in.
In the left pane, right-click Active Directory Domains and Trusts and select Properties.
Under Alternate UPN suffixes, type the name of the suffix you want to add.
Click Add and OK.
Using VBScript
' This code adds a new UPN suffix.
' ------ SCRIPT CONFIGURATION ------
strNewSuffix = "<NewSuffix>" ' e.g. othercorp.com
strDomain = "<DomainDNSName
>" ' e.g. rallencorp.com
' ------ END CONFIGURATION ---------
set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE")
set objPartitions = GetObject("LDAP://cn=Partitions," & _
objRootDSE.Get("ConfigurationNamingContext"))
objPartitions.PutEx ADS_PROPERTY_APPEND, "uPNSuffixes", Array(strNewSuffix)
objPartitions.SetInfo
Discussion
The UPN allows users to log on with a friendly name that may even correspond to their email address. UPN logons also do not require the domain to be known so that it can be abstracted away from the user. You may need to create an additional UPN suffix (e.g., @rallencorp.com) if you want UPNs to map to email addresses, but your AD forest is rooted at a different domain name (e.g., ad.rallencorp.com) than the domain name used in email addresses (e.g., rallencorp.com).
Using VBScript
UPN suffixes are stored in the multivalued
uPNSuffixes
attribute on the
Partitions
Get Active Directory Cookbook now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.