Home / server / Questions / 583817
In Process
soMuch2Learn
Asked: 2014-03-22 23:39:54 +0800 CST

Account name changes

  • 772

The way we currently handle account name changes is quite cumbersome and wondering if there is an easier way to go about things. Name change request comes through and we create a new AD account, mirroring the old one, then once a week we link the old mailbox to the new account, copy over their old personal network drive (roaming profiles), create the new accounts in specific soar they have access to (some Ldap, some not) disable the old account, enable the new, wait for user to call saying they can't get in.
The process leaves lots of room for error or skipped steps. Is there any downside to just outright changing given, samaccount name, display name on the original object instead of creating an entirely new account? How did your company handle name changes?
Thanks.

active-directory

2 Answers

  1. We generally change the full display name, create a new email address for the same account with the old one as an alias, and leave everything else the way it was. This has been standard among places I've worked.

    Example: "Mary Jones" gets married and wants everything to say "Mary Smith" now. She logs in as "mjones." We leave her username "mjones," change her full name to "Mary Smith," and create the "[email protected]" email address, leaving "[email protected]" as an alias.

    Advantages: Mary continues to receive email from people who have her old address. When she replies, it has her new name, and her new email address based on her new name is the default address. Her computer cheerfully calls her Mary Smith now.

    Disadvantages: Sometimes Mary throws a fit and tries to get us to change her login to "msmith." We generally say no, mainly because at one place all the identity management stuff was keyed off username and that would screw stuff up.

    I would personally resist creating a new account for someone with a name change. The mailbox, roaming profile, etc.... just no. Give her a new display name and call it a day.

    • 2

  2. Some applications - IIS in particular - may use identity information cached by Windows. If an account is renamed, that account may not work correctly for that application until the server where the information is cached is restarted.

    More information here:

    The LsaLookupSids function may return the old user name instead of the new user name if the user name has changed
    http://support.microsoft.com/kb/946358

    • 0