In Active Directory, is there apossibilityof userPrincipalName to be empty for a user object. I know for sure that when users are created using ADUC tool, theuserPrincipalName is always set. What would happen if the user is created using some scripts or other tools?

See for instance NTLM not negotiated without blank userPrincipalNamehttp://social.msdn.microsoft.com/Forums/en-US/wcf/thread/fed9998c-a719-4b97-8467-e70cee31dd35 But this is forum dedicated toExchange.You should pose your question in one of thee forums:Windows Server Generalhttp://social.technet.microsoft.com/Forums/en-US/winservergen/threads Windows Server 2008 R2 Generalhttp://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2general/threads Or see if it fits in the directory Services forumhttp://social.technet.microsoft.com/Forums/en-US/winserverDS/threadsMCTS: Messaging | MCSE: S+M | Small Business Specialist

Thanks, I have also posted this question in Active Directory forum(http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/4dc70d61-ef53-4614-9b1d-454aa451caa4). Based on the link that you provided, I infer that Kerberos Authentication would fail if UPN is not set. But I want know when this attribute would not be set in the Active directory Server. Thanks in Advance