| Previous | Next |
| ERROR_DS_SPN_VALUE_NOT_UNIQUE_IN_FOREST | ERROR_DS_MISSING_FOREST_TRUST |
ERROR_DS_UPN_VALUE_NOT_UNIQUE_IN_FOREST
The logon name collides with an existing forest-wide UPN
A UPN is an Internet-style logon name stored on a security principal. Active Directory domain controllers enforce forest-wide uniqueness for supported writes, including account creation, modification, rename, and restore. A duplicate would make interactive, Kerberos, and synchronized cloud identity resolution ambiguous even when the two objects live in different domains.
Search all forest domains for the complete UPN, including deleted objects when a restore is involved. Identify whether the collision is a stale account, a deliberately shared suffix with a reused prefix, or a synchronization artifact. Change the correct principal and verify the suffix is configured as intended. Directory Service event 2974 can show the blocked value and conflicting objects. Recheck after replication before retrying the write.
What to inspect
- Search the forest for the full userPrincipalName value.
- Include deleted objects when restoring an account.
- Review event 2974 on the DC that rejected the update.
References
- Microsoft: forest-wide UPN uniqueness
- Microsoft: UserPrincipalName format and identity use
- Microsoft: restoring deleted security principals
Looking for a different code? Search another status or error code.