User has 2 accounts each in domain1 and domain2 - samaccountname is the same in both domains user01

Hi,

Wondering if anyone has seen similar type of issue:

Currently on Lync2010 Server - having older Cumulative Update from 2012

In our organization we have usres that have dual IDs that are homed in separate domains using same samaccountname:

Domain1\user01  - Lync Enabled

Domain2\user02

Lync is enabled on Domain1\user01 --> if user is moving to new Org and wants Lync with same address enabled on Domain1\user01

- we remove/delete Lync account from Domain1\user01, enable Lync account on new account using same address Domain2\user02

This works, however Lync server gets confused:

If i follow step above,  User is not able to login using new account that was provisioned, cannot see presence.

get-csuser Domain1\user01  --> returns identity of Domain2\user01 user

get-csuser Domain2\user01 --> returns identity of Domain2\user01 user

Its seems that Lync canont differenciate between usres that have same samaccountname but on different domains.


  • Edited by AlinIliescu Monday, August 18, 2014 7:42 PM
August 18th, 2014 9:04pm

One Forest multiple domains or a Seperate Forest for Each Domain?  I assume seperate forest as SAMAccount name must be unique.  Also, are you dealing with only one SIP Domain or multiple?
Free Windows Admin Tool Kit Click here and download it now
August 19th, 2014 4:47pm

Hi,

Single forest, 2 domains.

for example we have a user in domain1\jondoe which is moving to new domain, they create new account on destination domain using same username naming convention.

domain1\jondoe Lync account has to be enabled now on domain2\jondoe

- Followed the obvious steps, removed/deleted Lync account from domain1\jondoe, waited 5 min, enabled Lync using same sip address on domain2\jondoe

- now the user can no longer login to Lync, presence unknown.

get-csuser domain1\jondoe returns identity of user domain2\jondoe   

get-csuser domain2\jondoe returns identity of user domain2\jondoe

I've opened a case with Microsoft as well just now, i'll provide more details.

August 19th, 2014 5:26pm

What is your sip domain and how are you having the user login?

Example

SIP Domain = user@notadomain.com

Login = Notadomain\User

this works, but when you move user from Notadomain.com to Notadomain2.com login fails with what credentials

Sip Domain = user@notadomain.com

Ntadomain2\User

Free Windows Admin Tool Kit Click here and download it now
August 19th, 2014 5:57pm

Also, did you prepare the secondary domain with the Lync wizard?
August 19th, 2014 6:01pm

Hey,

Both domains have been prepped using Lync Wizard. I can succesfully sip enable users from both domains.

SIP Domain of the user = user@sipdomain.com - same as email split DNS

domain1\sameusername - old account, SIP enabled, Lync to be enabled on domain2\sameusername

domain2\sameusername - destination account, to be enabled for Lync using same sip address as user domain1\sameusername - not before removing account.

Now lets say the user is moving BU, they dont move AD account, rather they create a new account in the secondary domain using same samaccountname that was used in domain1.


We delete Lync account from domain1\sameusername, and enable same sip address on domain2\sameusername

This results in user not able to login, Lync seems to be confused about using same samaccountname but from 2 different domains.

get-csuser domain1\samusername --> returns identity of domain2\sameusername  -- CN value

get-csuser domain2\samusername --> returns identity of domain2\sameusername  -- CN value

Not sure how this can happen since domain1\samusername Lync was removed and enabled on get-csuser domain2\samusername 

Free Windows Admin Tool Kit Click here and download it now
August 19th, 2014 7:16pm

Hi AlinIliescu,

It is expected.

The command Get-CsUser returns information about users in your organization who have been enabled for Lync Server.

You remove Domain1\user01, then you wont retrieve the user information.

As you have an AD account with the same samaccountname, it can also be found.

If you dont have that AD account, you get nothing by running the command.

Best Regard,

Lisa

September 4th, 2014 5:29am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics