Print logs wrong user after Azure AD sync — mapping & claims fix

Joe B.

Reviewed for technical accuracy

Specialities: Azure AD (Entra ID), Hybrid AD, Kerberos/NTLM, Print Servers, PaperCut, SafeCom

Wrong username in print logs — UPN mismatch after Entra ID sync, SID/claim mapping, print accounting repair

Technician

Hi! We’ll sort out why your print logs show the wrong user after the latest Azure AD (Entra ID) sync.
A few details help pinpoint the cause: Did UPN suffixes change (e.g., @contoso.local → @contoso.com)? Are jobs logged under the print server’s computer account or another user? Which product records usage (PaperCut, SafeCom, native Windows logs, or MFP accounting)? Any cross-forest trusts or new hybrid join?

Customer

Since we synced to Entra ID, our print accounting is wrong. PaperCut reports jobs from “SYSTEM” or from a different person. We did change UPNs to @contoso.com.

Technician

Understood. After directory changes, UPN mismatches and SID history gaps often break user resolution. On print servers, authentication can also fall back to NTLM, so PaperCut/SafeCom read the wrong identity. If you’re using claims-aware printing or Universal Print connectors, the claim mapping (UPN vs samAccountName) matters too.
Plan: 1) Confirm which attribute PaperCut maps to. 2) Check Kerberos/NTLM and SPNs on the print server. 3) Fix UPN, mail, or onPremisesSamAccountName mapping. 4) Resync and re-associate users so print logs show the correct username.

Customer

Where do I check the mapping PaperCut uses? We moved from DOMAIN\jdoe to jane.doe@contoso.com.

Technician

In PaperCut (Options → User/Group Sync), verify the primary user identifier. For hybrid tenants, set it to UPN or email and enable Link users by alternate IDs so SID/UPN changes don’t create duplicates.
If you use SafeCom/uniFLOW, choose an equivalent directory source and map userPrincipalName → system username. This prevents the classic wrong username in print logs after an Entra ID sync.

Customer

Logs also show jobs from the server account. Could this be authentication?

Technician

Yes. If clients connect over IP or a DNS alias without a proper SPN, Kerberos fails and the server may attribute the job to SYSTEM.
• Create/register the HOST/PRINTSERVER and cifs/ SPNs for the service account (or the computer account if using Local System).
• Ensure clients use the FQDN share (e.g., \\print01.contoso.com) so Kerberos works.
• In policies, prefer Kerberos over NTLM where possible. This alone often fixes print accounting wrong user.

Customer

We changed UPN suffixes. Some users kept printing as old DOMAIN\alias. How do we handle that?

Technician

Keep SIDHistory during migration and configure PaperCut’s username aliasing: map historical samAccountName to new UPN. Re-sync the directory and run the “Recalculate user ownership” tool on recent jobs so old entries are corrected to the right username.

Customer

We also enabled Azure AD Kerberos for SMB. Anything special for print queues?

Technician

For Azure AD Kerberos or Universal Print hybrid connectors, ensure the connector service runs as the intended identity and that the claim used (UPN/email) matches your accounting system. If Universal Print is only for discovery and jobs still spool on your server, the server’s auth rules apply (Kerberos + SPN).

Customer

After switching mapping to UPN and fixing SPNs, new jobs log correctly. Older entries are still wrong. Can we fix history?

Technician

Yes. In PaperCut’s admin, run Batch update or the recalculate user task to re-map historical jobs using your new UPN rule. In SafeCom/uniFLOW, export logs and re-import with a username translation table. This cleans up print logs wrong user records for reporting/billing.

Customer

Anything else to keep things stable going forward?

Technician

Guardrails:
• Standardize on UPN as the single identity across Entra ID, on-prem AD, and your print accounting tool.
• Keep SPNs correct; publish queues via FQDN only; avoid raw IP shares that force NTLM.
• Document a mapping policy for mergers/renames (alias → UPN) and schedule a nightly directory sync with error alerts.

Customer

Great — logs now show the correct users and our reports balance again. Thanks!

Technician

Summary: Fixing wrong user in print logs after Azure AD sync = align UPN mapping, keep SID history, ensure Kerberos with valid SPNs, and set PaperCut/SafeCom to resolve users by UPN/email with aliases. Need help implementing this on your server? Open the chat.

Quick answer: the accepted fix

Accepted fix when print logs show the wrong username after Entra ID sync: set your accounting tool to resolve users by UPN with aliasing for old samAccountName, verify Kerberos is used (not NTLM), register required SPNs, and re-sync the directory. Recalculate ownership for recent jobs to correct reports.

FAQ

Step-by-step (Hybrid AD / Print servers)

1. In PaperCut/SafeCom, set directory mapping to UPN (allow aliases for old usernames); run a sync.
2. Ensure clients connect to queues via FQDN; register required SPNs and verify Kerberos tickets (klist).
3. Keep SIDHistory during migrations; import alias tables to merge old accounts.
4. Recalculate job ownership for recent prints; validate that reports now show the correct username.

Note for mixed environments (macOS/Chromebooks)

1. For Google/Azure SSO printing, ensure the connector claims include UPN/email that matches your accounting tool.
2. Avoid raw IP printing that bypasses the server — it can’t attribute jobs correctly.

Sources

• Microsoft — Kerberos authentication overview
• Microsoft — User logon name (UPN) and suffix changes
• PaperCut — User & Group Sync and identity mapping

Matt ● replies in < 1 min

Technician Expert

⭐⭐⭐⭐⭐ Trusted by 27,000+ customers

Alex · Expert's Assistant

Send Message →

1 Tech Support Specialist is online right now.