| Previous | Next |
| STATUS_DS_FLAT_NAME_EXISTS_IN_FOREST | STATUS_FATAL_USER_CALLBACK_EXCEPTION |
STATUS_INVALID_USER_PRINCIPAL_NAME
The UPN supplied for authentication is invalid
A UPN is often the bridge between a certificate identity, logon name and Active Directory account. In PKINIT and smart-card logon, an invalid UPN can prevent the KDC from mapping the presented identity to the intended user.
Check the exact value, not only how it is displayed. Problems include malformed names, stale suffixes, duplicate or missing account mappings, and certificates that contain a name that no longer matches the AD account.
What to inspect
- Inspect the certificate SAN/UPN and the account userPrincipalName attribute.
- Check for renamed domains, removed UPN suffixes or duplicate identities.
- Correlate with PKINIT name-mismatch and certificate-mapping events.
References
- Microsoft Open Specifications: MS-PKCA PKINIT in Kerberos
- RFC 4556: PKINIT
- Microsoft: Smart card certificate requirements
- Microsoft Open Specifications: NTSTATUS values
- Microsoft Support: certificate-based authentication changes
Looking for a different code? Search another status or error code.