Investigate SPN and UPN collisions from directory-service events

Use this document to resolve one bounded operational decision: Investigate SPN and UPN collisions from directory-service events. Only the official source and traced locations below supply facts. Confirm applicability before acting.

Source fact:

The official SPN and UPN uniqueness from Microsoft supports the following bounded statements:

• The directory enforces UPN uniqueness during user creation and documents the resulting failure paths. The research record locates this support at Section: New user creation fails if UPN isn’t unique.
• Event 2974 from ActiveDirectory_DomainService is documented as evidence for uniqueness conflicts. The research record locates this support at Section: Event 2974 Source: ActiveDirectory_DomainService.

Keep the evidence boundary at these traced claims. They support a review of forests, domains, controllers, directory partitions, trusts, sites, replication links, service accounts, and delegated roles; they do not support conclusions outside the source’s stated conditions.

What the source does not establish

Do not delete or overwrite a conflicting identifier until account ownership and service dependencies are known. The citation is not a substitute for observed state, authorization, compliance evidence, or dependency health. Examine Windows DNS, time synchronization, network reachability, PKI, backups, virtualization safeguards, and privileged identity before translating the source into an operational decision.

Applicability questions

• For source statement 1 at Section: New user creation fails if UPN isn’t unique, which observable configuration, record, or test can confirm applicability here?
• For source statement 2 at Section: Event 2974 Source: ActiveDirectory_DomainService, which observable configuration, record, or test can confirm applicability here?
• What inventory proves which parts of forests, domains, controllers, directory partitions, trusts, sites, replication links, service accounts, and delegated roles are in and out of scope?
• Which condition in Windows DNS, time synchronization, network reachability, PKI, backups, virtualization safeguards, and privileged identity must be healthy before evidence is trustworthy?
• What result would disprove the working assumption and return the issue to the owner?

DSE recommendation:

DSE recommends using the cited source as the evidence anchor for this decision. Anchor the review in the cited section and keep observation separate from interpretation. Record the source location, examined part of forests, domains, controllers, directory partitions, trusts, sites, replication links, service accounts, and delegated roles, observed and expected states, owner, and reason for deviation.

Translate the conclusion into change control only after documenting dependencies, impact, test method, expected signals, failure signals, and restoration steps. Include Windows DNS, time synchronization, network reachability, PKI, backups, virtualization safeguards, and privileged identity, while excluding secrets and sensitive personal or topology data from ordinary tickets.

Verification and evidence

A reviewer should be able to retrace the decision from Section: New user creation fails if UPN isn’t unique; Section: Event 2974 Source: ActiveDirectory_DomainService through directory and policy exports, replication and locator tests, event logs, trust state, role ownership, and controlled authentication tests. Record what was collected, where, when, by whom, and which system or role it represents.

Keep before-state evidence, approval, test or change result, exceptions, and after-state evidence together. Use an approved lab, window, or nonproduction path for risky tests. Set a recheck trigger for version, architecture, dependency, vendor, incident, or ownership change. A check proves only what was observed.

Official references

• SPN and UPN uniqueness — Microsoft