Hi,
I'm in the process of configuring a Server 2012 r2 DC in preparation for O365 SSO with Azure AD Connect. The domain only has 1 DC and the functional level is also set to 2012 r2. As part of this I am changing the UPN for the on-prem accounts
to match their email address as follows:
Firstname: Test
Surname: Account
Original Username: TestA
Original UPN: TestA@Domain.domainname.co.nz
SMTP address: test.account@domainname.co.nz
I've added in domainname.co.nz as a suffix and can see it as an option, but when I change the on-prem UPN to be test.account@domainname.co.nz it works correctly and still allows the user to logon, but a short time later I find the UPN reverts itself back
to testa@domain.domainname.co.nz.
I've turned on auditing to work out how/when this was happening and can see that an event 4738 is raised from my admin account when I initially change the UPN, and shortly after (always at the same time of the hour, at 37 mins past) this is changed back
by the system account, as shown below:
A user account was changed.
Subject:
Security ID:
SYSTEM
Account Name:
servername$
Account Domain:
DOMAIN
Logon ID:
0x208C31D6
Target Account:
Security ID:
DOMAIN\testuser1
Account Name:
testuser1
Account Domain:
DOMAIN
Changed Attributes:
SAM Account Name:
-
Display Name:
-
User Principal Name:
testuser1@DOMAIN.DOMAINNAME.CO.NZ
I've checked for scheduled tasks, any services running under this account, and other apps on the server and can't find anything. Has anyone come across this before or have any advice on what else can be checked? It happens regardless of which
OU the account is in.
Thanks in advance!