How to Change Username in Active Directory?

6.3K

Renaming a user account in Active Directory is a common administrative task that is needed when an employee changes their name, gets married or divorced, or when a typo is made when creating the account. The administrator can use several tools to change the username, including graphical Active Directory (AD) administrative snap-ins, PowerShell cmdlets (Rename-ADObject and Set-ADUser), and command-line tools (dsmod and dsmove).

Best Practices for Changing Username in AD

There are several different attributes of an AD user account that can contain the username in one format or another.

Attribute	Description
canonicalName	A self-constructed default name that includes the path
cn (Common Name)	The relative distinguished name (RDN). Is a part of the distinguishedName (unique within the OU)
displayName	A user-friendly name displayed in AD, Outlook, Global Adress Lists, etc
givenName (First Name)	User’s first name
sn (Surname/Last Name)	User’s last name
initials	User’s initials
sAMAccountName	Login name used for authentication (pre-Windows 2000 logon name)
userPrincipalName (UPN)	Unique user’s email-like login name
distinguishedName (DN)	Full LDAP path to the user object

Renaming Users in Hybrid Active Directory and Microsoft Entra ID Environments

In case you organization use Active Directory Domain Services together with Microsoft Entra ID sync, renaming a user requires additional validation. Before changing the userPrincipalName (UPN),  you should verify the following:

1. The new UPN suffix exists in Active Directory.

You can check available UPN suffixes with the following command:

Get-ADForest | Select-Object -ExpandProperty UPNSuffixes

2. The corresponding custom domain is verified in Microsoft Entra ID

As example:

contoso.com

must be configured as a verified domain before it can be used as a UPN suffix.

3. Test the change with pilot users before applying it broadly

4. Monitor sync after the change

For environments using Microsoft Entra Connect Sync, you should run a delta sync:

Start-ADSyncSyncCycle -PolicyType Delta

Then you need to verify that the cloud user object has the expected UPN:

Get-MgUser -UserId user@contoso.com |
Select-Object DisplayName,UserPrincipalName

After sync, check the following:

• Microsoft 365 sign-in works;
• Teams profile is updated;
• OneDrive access is preserved;
• enterprise apps using SSO continue working.

Attributes that cannot be renamed or changed

Most user name-related attributes can be changed in AD using standard administrator tools. However, there are a number of immutable (non-renamable) attributes that cannot be renamed or changed. These are:

• distinguishedName — сannot be directly renamed. The value can only be changed when the user is moved (via Move-ADObject) to another OU.
• objectGUID — object’s globally unique identifier (GUID).
• objectSid — domain-unique security identifier (SID).

Immutable Identity Attributes in Hybrid Environments

In hybrid AD and Microsoft Entra ID environments, you should distinguish between on-premises immutable attributes and cloud identity identifiers.

The following Active Directory attributes are considered immutable:

• objectGUID — a unique identifier assigned to the AD object.
• objectSid — the security identifier used for authorization within the domain.
• distinguishedName — cannot be modified directly; it changes automatically when the object is renamed/moved.

When syncing users to Microsoft Entra ID, the relationship between the on-premises AD object and the cloud object is maintained by the sourceAnchor attribute (also known as ImmutableId in Microsoft Entra ID), not by the user’s UPN.

Here are the common sourceAnchor attributes:

• ms-DS-ConsistencyGuid (recommended for many Microsoft Entra Connect deployments)
• objectGUID

Because sourceAnchor is designed to remain unchanged during the object’s lifetime, you can update attributes such as UPN, display name, surname, and email addresses without creating a new identity when sync is configured correctly.

Full Name and DisplayName

The administrator also needs to understand the differences between the following values:

• Full Name — This is the username specified when a new user is created through the ADUC “New User” wizard. The full name field becomes part of the LDAP attribute cn (Common Name). This value is what you see as the user object name in the right pane of ADUC console (must be unique within the OU).
• DisplayName — is a separate LDAP attribute, used as the human readable label in address books. By default, it is auto-generated from the givenName/sn when the user is created (it does not have to be unique).

Important! In hybrid Microsoft Entra ID environments, changing a user’s UPN requires additional planning. Before changing the UPN, you need to check if the new domain suffix is configured and verified in Microsoft Entra ID, test the process on pilot users, and monitor sync after the change. A UPN change can affect Microsoft 365 sign-in, SSO integrations, Teams, OneDrive, and third-party apps that use the user’s identity. You should check if the cloud user object remains matched with the on-premises AD account after syncing.

Note that the UPN is not the primary identifier used for sync matching. In hybrid environments, Microsoft Entra Connect typically uses the sourceAnchor (Immutable ID) to maintain the relationship between the on-premises AD object and the cloud object. However, incorrect rename procedures can still result in duplicate cloud accounts/sign-in issues.

Active Directory on Windows Server 2025

Windows Server 2025 introduces new Active Directory Domain Services improvements that are relevant for large enterprise environments.

One of the major AD DS changes is support for the Database 32k pages optional feature. The larger database page size improves AD scalability by allowing the directory database to handle larger objects and more values in multi-valued attributes.

New Windows Server 2025 AD forests and domains are created with a 32k-capable database format. However, existing upgraded DCs continue using the 8k database format until the optional feature is enabled. Enabling 32k pages is a forest-wide operation and requires all DCs to support the new database format.

Before enabling the feature in production, you should:

• verify that all DCs are running Windows Server 2025 or later;
• check AD replication health;
• verify backup compatibility;
• test the change in a non-production environment.

You can check whether DCs support the 32k database format with:

Get-ADObject `
-LDAPFilter "(ObjectClass=nTDSDSA)" `
-SearchBase "CN=Configuration,DC=contoso,DC=com" `
-Properties msDS-JetDBPageSize |
Select-Object DistinguishedName,msDS-JetDBPageSize

A value of 32768 indicates a 32k page capable DC.

Renaming Users in Active Directory Users and Computers (ADUC)

The easiest and most intuitive way to rename an AD user using the Active Directory Users and Computers graphical snap-in (ADUC).

1. Open the ADUC console by running the dsa.msc command (on a DC or a computer with the AD RSAT installed).
2. Use the Active Directory search to find the target user account. Right-click the user and click Rename.
   

   

   Or expand the Active Directory OU where the user is located, right-click on the user, and click Rename.
   

   

3. In the “Rename User” window that opens, you can change the Full name (Canonical name of the object), First name, Last name, Display Name, as well as the userPrincipalName and userlogonname (samAccountName) attributes. Click OK to save the changes.
   

   

4. Changing the First name or Last name automatically changes the DisplayName. In this case, the Full Name doesn’t change and must be updated manually.

The administrator can manually change user attribute values in the Attribute Editor tab.

How to Rename AD User with PowerShell

The PowerShell Active Directory module offers two basic cmdlets for renaming users:

• Rename-ADObject — changes the Relative Distinguished Name (RDN/CN). As a result, the distinguishedName attribute is automatically updated by AD.
• Set-ADUser — allows you to change givenName, Surname, displayName, and other attributes.

To change the user distinguishedName (Relative Distinguished Name, RDN), first get the user object using the Get-ADUser, and then use the pipe with Rename-ADObject:

Get-ADUser cwilson | Rename-ADObject -NewName 'Chris Wilson'

Let’s review the results. Run this command to show specific attributes.

Get-ADUser cwilson -Properties DisplayName, Surname |

Select-Object ObjectGUID, DistinguishedName, Name, DisplayName, GivenName, Surname

In this case the Rename-ADObject changed only the RDN and Name attributes to match the new name. The GivenName and DisplayName are unaffected. Why? Because the Rename-ADObject command is a general-purpose cmdlet to rename AD objects, such as computers and groups, to which the GivenName and Surname do not apply.

The following command updates the user’s GivenName, Surname, and DisplayName attributes.

Get-ADUser cwilson | Set-ADUser -GivenName Chris -Surname Wilson -DisplayName 'Chris Wilson'

Set-ADUser updates user attributes such as GivenName, Surname, and DisplayName, but note that it does not rename the object’s CN or DistinguishedName.

If you need to rename the login name and user principal name attributes, use the -SamAccountName <new SAM> and -UserPrincipalName <new UPN> parameters.

If you need to rename multiple users, you can automate the process with PowerShell by importing user information from a CSV file and processing each account in a loop.

Managing Additional AD Attributes with Set-ADUser

The Set-ADUser cmdlet provides several parameters for managing AD attributes that are not available as dedicated cmdlet options. In enterprise environments, you may need to update additional LDAP attributes during user renaming operations (such as department information, employee IDs, or Exchange-related attributes).

Using -Replace to Modify LDAP Attributes

The -Replace parameter allows you to update LDAP attributes that do not have dedicated parameters in Set-ADUser. For example, to update the user’s department and job title, you can use the following command:

Set-ADUser -Identity cwilson `
-Replace @{
department="Finance"
title="Senior Accountant"
}

You can also use -Replace to update attributes such as employeeID:

Set-ADUser -Identity cwilson `
-Replace @{
employeeID="12345"
}

Using -Add to Add Attribute Values

The -Add parameter is used to add values to multi-valued AD attributes. For example, when renaming a user in a hybrid Microsoft Entra ID environment, you may need to keep the previous email address as an alias:

Set-ADUser -Identity cwilson `
-Add @{
proxyAddresses="smtp:old.name@contoso.com"
}

This allows users to continue receiving email sent to their previous address.

Using -Clear to Remove Attribute Values

The -Clear parameter removes values from an AD attribute. Here is an example:

Set-ADUser -Identity cwilson `
-Clear department

Using -PassThru to Return the Updated Object

By default, Set-ADUser does not return the modified user object after making changes. The -PassThru parameter returns the updated object, which allows you to verify changes/continue processing the object in a pipeline.

Here is an example:

Set-ADUser cwilson `
-DisplayName "Chris Wilson" `
-PassThru |
Select-Object Name,DisplayName

Rename All User Name Attributes in One Operation

In most production environments, you can update all relevant user name attributes during the same operation to keep the account consistent. The example below renames the object’s CN (RDN), updates the user’s first and last name, display name, sAMAccountName, and UserPrincipalName.

# Use ObjectGUID because CN and SamAccountName may change during rename

$user = Get-ADUser "cwilson"
Rename-ADObject -Identity $user.DistinguishedName `
-NewName "Chris Wilson"

Set-ADUser -Identity $user.ObjectGUID `
-GivenName "Chris" `
-Surname "Wilson" `
-DisplayName "Chris Wilson" `
-SamAccountName "chwilson" `
-UserPrincipalName "chris.wilson@contoso.com" `
-PassThru

You can verify the changes by running the following command:

Get-ADUser "chwilson" `
-Properties DisplayName,GivenName,Surname,SamAccountName,UserPrincipalName |
Select-Object Name,
DisplayName,
GivenName,
Surname,
SamAccountName,
UserPrincipalName,
DistinguishedName

Verifying User Rename in Hybrid Environments

In hybrid AD and Microsoft Entra ID environments, you should verify that the renamed user account is correctly synced after changing identity attributes.

First, you need to check the updated user attributes in on-premises AD. Use the following command:

Get-ADUser chwilson -Properties UserPrincipalName |
Select-Object Name,UserPrincipalName

After sync, check the corresponding Microsoft Entra ID user object:

Get-MgUser -UserId chris.wilson@contoso.com |
Select-Object DisplayName,UserPrincipalName,OnPremisesSyncEnabled

The verification should confirm that:

• the on-premises AD user has the expected UPN;
• the Microsoft Entra ID user object has the updated UPN;
• the user remains synced with the original on-premises account.

Recommended Method: PowerShell Automation

Keep in mind that PowerShell is the preferred method for user rename operations for modern AD administration. It provides you with better error handling, supports automation, and integrates with hybrid identity environments.

Here is an example:

$user = Get-ADUser -Identity cwilson

Rename-ADObject -Identity $user.DistinguishedName `
-NewName "Chris Wilson"

Set-ADUser -Identity cwilson `
-GivenName "Chris" `
-Surname "Wilson" `
-DisplayName "Chris Wilson" `
-UserPrincipalName "chris.wilson@contoso.com"

Legacy Command-Line Tools: dsmod and dsmove

Note. The dsmod, dsmove, and dsquery utilities are legacy AD command-line tools. They are still available in supported Windows Server versions, but PowerShell (ActiveDirectory module) is the recommended automation and admin method in modern enterprise environments.

Before PowerShell and the ActiveDirectory module, there was the Management and Tools for Windows Server. Part of the suite is the dsmove and dsmod commands.

• dsmove — Moves a single AD object to another path or renames RDN the same AD object without moving.
• dsmod user — Modifies the attributes of an Active Directory user.

First, find the user to rename using the dsquery user command. This step is optional and only for comparison of results later.

dsquery user -samid cwilson | dsget user -dn -display -fn -ln

Once we confirm the user, run this command to rename it:

# Rename

dsquery user -samid cwilson | dsmove -NewName 'Christopher Wilson'

# Display Attributes

dsquery user -samid cwilson | dsget user -dn -display -fn -ln

As expected, the command only renamed the user’s RDN, and the first, last, and display names are untouched.

To change the first name, last name, and display name, we must run the dsmod command.

dsquery user -samid cwilson | dsmod user -fn 'Chris' -ln "Wilson" -display 'Chris Wilson'

How to Rename an Active Directory User with ADSI Edit

While impractical and risky, you can use the ADSI Edit tool to rename a user. ADSI Edit is a low-level editor, which means you can change any value without error-checking and validation.

But if you’re in a situation where you can only use ADSI Edit, here’s how.

1. Run the adsiedit.msc command to launch the ADSI Edit.
2. Click Action → Connect to → Select a well known Naming Context (Default naming context) → OK.
   

   

3. Navigate to the OU where the user to rename is located.
4. Right-click on the user object and click Properties.
   

   

5. Double-click to edit the following attributes to rename the user.
   • displayName — The user’s display name.
   • givenName — The user’s first name.
   • sn — The user’s last name.
     

     

     You can also modify the samAccountName and userPrincipalName to change the user’s logon name and UPN.

A couple of reminders when using this method to rename a user in Active Directory.

• Keep in mind that distinguishedName cannot be edited directly. It changes automatically when the object’s RDN is renamed or when the object is moved to another OU.
• You cannot rename the cn (full name) attribute because the system owns it. You will get the following error if you attempt to modify this attribute:

Operation failed. Error code: 0x20b1

The attribute cannot be modified because it is owned by the system

000020B1: UpdErr: DSID-030F14F0, problem 6004 (CANT_ON_RDN), data 0

Wrapping up

Therefore, renaming a user is a common and safe operation within on-premises AD domains, which can be performed through the ADUC GUI or the command line. However, be careful when renaming a user’s UPN that is synchronized with Entra ID. Because this can result in sync failures, duplicate accounts, and access issues with OneDrive or Teams.