troubleshooting Question

Random accounts locking after global UPN change

Avatar of Chris H
Chris HFlag for United States of America asked on
Active Directory* kerberos
5 Comments1 Solution484 ViewsLast Modified:
I was instructed to change the UPN for users because of O365 migration and Bit Titan.  I tested with my user account and everything seemed to work fine.  I did every user's and now I'm getting a bunch of Kerberos errors like this:


A Kerberos authentication ticket (TGT) was requested.

Account Information:
      Account Name:  
      Supplied Realm Name:      DOMAINNAME.LOCAL
      User ID:                  NULL SID

Service Information:
      Service Name:            krbtgt/DOMAINNAME.LOCAL
      Service ID:            NULL SID

Network Information:
      Client Address:            ::ffff:
      Client Port:            57618

Additional Information:
      Ticket Options:            0x40810010
      Result Code:            0x6
      Ticket Encryption Type:      0xFFFFFFFF
      Pre-Authentication Type:      -

Certificate Information:
      Certificate Issuer Name:            
      Certificate Serial Number:      
      Certificate Thumbprint:            

Certificate information is only provided if a certificate was used for pre-authentication.

Pre-authentication types, ticket options, encryption types and result codes are defined in RFC 4120.


There are 3 new UPNs that are different based off of which department the users are in, but they're all still members of the same domain realm in AD.  It looks like the Kerberos ticket includes the FQDN(with the new UPN) as the authenticating accountname, but is trying to access using the old domain realm.  Obviously this is going to fail..  

Anyone seen this issue before?  

Anyone know if adding the suffix's to Domains and Trusts will fix this and is a smart thing to do?

Any help is welcome.

Thanks in advance!

Chris H
Infrastructure Director

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 5 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 5 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros