Once the account has been created, you can use the "Active Directory Users and Computers" applet on the Windows Server, find the account, open up the properties, and perform one of the following:
Option A:
- Click on the "Account" tab
- Edit the 2nd box of the "Windows login name (pre-Windows 2000)" field
- Click the "Apply" button
Option B:
- Click on the "Attribute Editor" tab (shown if "Advanced Features" is turned on)
- Look for "sAMAccountName" in the listbox
- Double click on the "sAMAccountName" item - a small dialog box will pop up
- Edit the name in the textbox
- Click the "OK" button (closed the dialog box)
- Click the "Apply" button
If you haven't enabled Kerberos yet, you can edit the Active Directory "Account Attribute Template" value under the "Advanced kerberos-env" section on the "Configure Kerberos" page of the "Enable Kerberos Wizard" and add something like:
"sAMAccountName": "$principal_name"
However this field is limited to 20 characters so you will need to do some additional stuff to limit the value and hope that it is unique. For example:
#set( $sAMAccountName = "${principal_primary}-${principal_digest}" )
{
"objectClass": ["top","person","organizationalPerson","user"],
"cn": "$principal_name",
"sAMAccountName": "$sAMAccountName.substring(0,20)",
#if( $is_service )
"servicePrincipalName": "$principal_name",
#end
"userPrincipalName": "$normalized_principal",
"unicodePwd": "$password",
"accountExpires": "0",
"userAccountControl": "66048"
}
