User auto created in AX 2012 without AD group user

(1) Share

Report

Posted on by André Arnaud de Cal...

301,248 Super User 2025 Season 2

Hi all,

It is possible to add users in AX with the type Active Directory group. In this case when a user is member of the AD group, the user will be automatically created in AX with a user ID starting with a dollar sign (e.g. $591F).

At a customer we are not using the AD groups for security, but there are two users added automatically with this pattern. These two are really auto created. The company is migrating users from an old domain to a new. These users were part of the old domain and were setup in AX with the user ID of the old domain.

Can anyone confirm that a link between the AD users (old and new domain) could cause the "new" user to be recognized and thus added in AX like the AD group? Does these users also inherit the permissions of the already existing user?

*This post is locked for comments

I have the same question (0)

All responses (15)

Answers (0)

Ihab Barghout 605 on at

Like (1)

Report

Dear André,

I don't have much knowledge about windows security, but after your post I have tested the following on the UserInfo table:

Test 1:

1. Stopped AOS.

2. Modified the values of NetworkAlias and NetworkDomain for the AOS service account (used invalid values)

When starting the service, it started successfully.

When applying the same for different users, the users were able to login.

Test 2: Modifying the SID of the user. When doing so the users were aunable to login.

So I think it is all about SID. If the SID is migrated from old domain to a new domain, the users will be recognized.

Hope I am right :)

Regards,

Was this reply helpful? Yes No
André Arnaud de Cal... 301,248 Super User 2025 Season 2 on at

Like (1)

Report

Hi Ihab,

Thanks for your reply, but this is not related to my issue.

You are referring to changed SID settings. We did not touch that. The old user account is also still able to login.

The issue is that I do have a user (e.g. "Robin Naylor") who has now two login accounts. One is on the old domain and another new was provided some days ago. When he logs in on his machine with the new login, he also wanted to start AX. Before we had changed the user account in AX, he already started AX.

This caused to have the user twice in the system: The old account and a new generated account with user ID like '$591F'.

Was this reply helpful? Yes No
Denis Macchinetti 16,444 on at

Like (0)

Report

Hi André

I never faced this scenario.

However, I think this is a bug.

Seems that AX after not being able to search for the user through SID, use Alias.

Found the record and so call the auto creation process.

Anyway, I think you can open a case in MS.

Was this reply helpful? Yes No
André Arnaud de Cal... 301,248 Super User 2025 Season 2 on at

Like (1)

Report

Hi Denis,

Thanks for the reply. The naming convention on network alias is different between the old and new domain. So in this scenario a same Alias is not the case. I think it is related to a connection between the users itself. e.g. OLDDOMAIN\RNA is migrated to NEWDOMAIN\RNaylor.

They still have to migrate me to the new structure, so that would be an interesting option to do some additional testing. But that migration could take some months.

I have the feeling it is caused by linked accounts where AX then thinks it should do something similar as the AD groups.

I'm wondering if anyone could confirm this. I agree that it might appear to be a bug.

Was this reply helpful? Yes No
Community Member on at

Like (0)

Report

Hi Andre,

Stumbled upon your post here in search of an answer myself, I was just wondering if you ever figured out if this was a bug or if there's a way of getting the user's "Alias" to show instead of the dollar sign.

Regards,

Joakim

Was this reply helpful? Yes No
André Arnaud de Cal... 301,248 Super User 2025 Season 2 on at

Like (0)

Report

Hi Joakim,

The $ sign is probably by design, but I don't understand why.. I did not got the opportunity yet to find the coding where this user is created.

About the creation of the user where there is no AD group, I think this is a bug but we haven't logged this a issue yet.

Was this reply helpful? Yes No
SecondTry 50 on at

Like (0)

Report

Hi, my company is in the process of migrating existing users fron old AD to new AD and I am experienceing this issue randomly.

Did anyone solve this or found out why this happens?

What I am doing in this process is updating table USERINFO with new NETWORKDOMAIN and also updating SID with new value from new AD.

During this work I am confused as to why some users pop up as "$D0A5" users.

-Anders

Was this reply helpful? Yes No
André Arnaud de Cal... 301,248 Super User 2025 Season 2 on at

Like (0)

Report

Hi Anders,

I have not found a reproducible scenario yet. Like you can read in the question, I do have the feeling that there might be a link between the "old" and the "new" user. When a user is logged on with his new domain account and the old user account is still an active user in AX, it might work similar to having an AD group user.

The "$D0A5" is a pattern that is generated when the user is created automatically. This is done by logic in the kernel. I'm not a fan of this "naming convention".

Was this reply helpful? Yes No
SecondTry 50 on at

Like (0)

Report

Hello, I can now re-produce this.

The $user is created when I try to log on to AX with newdomain\anders.pettersen.

To delete the $user I had to kill all online user session both my users had, logoff AX and have another admin delete $user.

Was this reply helpful? Yes No
André Arnaud de Cal... 301,248 Super User 2025 Season 2 on at

Like (0)

Report

Hi Anders,

Can you check if your new user on the new domain has some connections with the old domain in Active Directory?

Was this reply helpful? Yes No