Since Windows 2000 NTLM has been replaced with Kerberos. Thus Kerberos uses UPNs to identify the users. UPN is also the preferred usernaming format.
Now, why does Windows 7 still display a logged in AD user by default as DOMAIN\USER
instead of USER@REALM
? This happens only when I explicitly log in with the UPN. Same happens in SharePoint, file properties dialog and so forth. I presume that this is done by SSPI automatically.
I know that AD internally works with SIDs but Kerberos does not. At least my GSS-API does not provide access to the PAC, I solely rely on the implicit UPN which is of course not findable through LDAP. (Note the attribute userPrincipalName
can be reset to any arbitrary value like the explicit UPN (enterprise principal).
Edit: here is another good reason why this crap is still around. Hopefully, this legacy will be gone with Windows 9. Windows NT 4 is dead, fortunately. And another one finally deprecated. So, someday Windows should show Kerberos realms in the domain logon dropdown box instead of NetBIOS names.