Question

I’m currently troubleshooting an Intranet application hosted at our company. In this application, Windows Authentication (Integrated Mode) is used to obtain the IPrincipal object for the current user and the current user’s name (i.e. “DOMAIN\Joe123”). Our domain is 4 characters long, so the individual who put this code together is grabbing just the substring containing the current user’s login name as follows:

 private string GetUserID()
 {

     string userId = "";
     if (User.Identity.Name.ToString().Length > 5)
     {
         userId = User.Identity.Name;
         userId = userId.Substring(5);
     }

     return userId;
 }

The problem we are running into is that we have a user whose login name was recently changed. We have two Domain Controllers running Windows Server 2003 R2 from which we can manage Active Directory credentials. This user has been modified in Active Directory to have a new login name, new e-mail address, new profile location (roaming profiles in use), and new Exchange mailbox / alias (running Exchange 2007). This was done after the given individual married and changed her last name. I can’t find a single place in Active Directory or Exchange Management where the new login name is not reflected.

This user can log in to our domain with her new login name. However, the IPrincipal object accessed via the code above is still reporting the user’s previous login name.

To date, her machine has been restarted, all cookies have been cleared, and the application pool for our Intranet application has been recycled. I’m wondering what other steps might be necessary to update the Name value returned in the IPrincipal object.

Answer 1

I believe that lookup is cached on the server.

MS KB: The LsaLookupSids function may return the old user name instead of the new user name if the user name has changed on a domain controller

A server reboot may fix this as well.