How to disable the Subject Alternative Name for UPN mapping
Updated: May 5, 2010
Applies To: Windows 7, Windows Server 2008, Windows Server 2008 R2, Windows Vista
User Principal Name (UPN) mapping is a special case of one-to-one mapping used in Active Directory. In Windows Server® 2008 R2, it is possible to turn off UPN mapping on a domain and use other explicit mapping by disabling the Subject Alternative Name (SAN) through the Registry Editor.
This setting is typically used when the deployed client certificate contains a SAN extension with a value you wish to ignore in favor of an explicit mapping.
Disabling the SAN for UPN mapping
Open the Registry Editor
Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc.
Change the value of the DWORD UseSubjectAltName to 00000000.
The value of UseSubjectAltName needs to be set on all KDCs for the domain.
For a clearer understanding of SAN and UPN mapping: