How to disable the Subject Alternative Name for UPN mapping

Updated: May 5, 2010

Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista

User Principal Name (UPN) mapping is a special case of one-to-one mapping used in Active Directory. In Windows ServerĀ® 2008 R2, it is possible to turn off UPN mapping on a domain and use other explicit mapping by disabling the Subject Alternative Name (SAN) through the Registry Editor.

This setting is typically used when the deployed client certificate contains a SAN extension with a value you wish to ignore in favor of an explicit mapping.

Disabling the SAN for UPN mapping

  1. Open the Registry Editor

  2. Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc.

  3. Change the value of the DWORD UseSubjectAltName to 00000000.


The value of UseSubjectAltName needs to be set on all KDCs for the domain.

Additional Information

For a clearer understanding of SAN and UPN mapping: