Active Directory Cookbook

6.32. Creating a UPN Suffix for a Forest

Problem

You want users to have a different User Principal Name (UPN) suffix from the default provided by your forest.

Solution

Using a graphical user interface

1. Open the Active Directory Domains and Trusts snap-in.

2. In the left pane, right-click Active Directory Domains and Trusts and select Properties.

3. Under Alternate UPN suffixes, type the name of the suffix you want to add.

4. Click Add and OK.

Using VBScript

' This code adds a new UPN suffix.
' ------ SCRIPT CONFIGURATION ------
strNewSuffix = "<NewSuffix>"   ' e.g. othercorp.com
strDomain = "<DomainDNSName>"  ' e.g. rallencorp.com
' ------ END CONFIGURATION ---------

set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE")
set objPartitions = GetObject("LDAP://cn=Partitions," & _
                              objRootDSE.Get("ConfigurationNamingContext"))
objPartitions.PutEx ADS_PROPERTY_APPEND, "uPNSuffixes", Array(strNewSuffix)
objPartitions.SetInfo

Discussion

The UPN allows users to log on with a friendly name that may even correspond to their email address. UPN logons also do not require the domain to be known so that it can be abstracted away from the user. You may need to create an additional UPN suffix (e.g., @rallencorp.com) if you want UPNs to map to email addresses, but your AD forest is rooted at a different domain name (e.g., ad.rallencorp.com) than the domain name used in email addresses (e.g., rallencorp.com).

Using VBScript

UPN suffixes are stored in the multivalued uPNSuffixes attribute on the Partitions