1. Open Active Directory Domains and Trusts. To open Active Directory Domains and Trusts, click Start , click Administrative Tools , and then click Active Directory Domains and Trusts .
2. In the console tree, right-click Active Directory Domains and Trusts , and then click Properties .
3. On the UPN Suffixes tab, type an alternative UPN suffix for the forest, and then click Add .
4. Repeat step 3 to add additional alternative UPN suffixes.

To add alternate UPN suffix to an existing domain user account:

1. Go to Administrative Tools > Active Directory Users and Computers.
2. On Active Directory Users and Computers snap-in, from the console tree in the left pane, double-click to expand the domain name.
3. From the displayed list, click to select Users container.
4. In the right pane, right-click the user for which alternate UPN suffix is to be added.
5. From the displayed context menu, click Properties.
6. On the opened properties box, go to Account tab.
7. On the selected tab, under User logon name section, choose the alternate UPN suffix from the drop-down list that was created earlier in Active Directory Domains and Trusts snap–in.
8. Once selected, click OK to save the modified settings.
9. Close Active Directory Users and Computers snap-in when done.

Error:

1. I can logon successfully on the client computer with a normal account.
2. If I logon to a DC, this message pop up:
   “The sign-in method you’re trying to use isn’t allowed. For more info, contact your network administrator.”

This only happened on the domain controller, so it may be a policy for the domain controller instead of all domain computers.

Solution:

Logon to a DC with admin account. In the Group Policy Management window Click Group Policy Management

1. Click Forest <yourforestname>, Click Domains ,  Click <yourdomainname>

2. Click Group Policy Objects, Click Default Domain Controllers Policy, Right Click on Default Domain Controllers Policy and select Edit by click.  This opens a Group Policy Management Editor window.

3. In the Group Policy Management Editor window, click Default Domain Controllers Policy (<yourservername>.<yourdomainname>)

4. Click Computer Configuration,  Policies, Windows Settings, Security Settings, Local Policies, User Rights Assignments. This causes the right pane in the opens a Group Policy Management Editor window to populate with a list on policies.

5. In the right pane in the opens a Group Policy Management Editor window double click Allow log on locally.  This opens an Allow log on locally Properties window.

6. In the Allow log on locally Properties window click the button Add User or Group..  This opens an Add User or Group window.

7. In the Add User or Group window type the name to be added or click Browse.. to search for a name.

8. After a valid user or group name is typed into the edit box in the Add User or Group window click OK.  This brings you back to the Allow log on locally Properties window .

9. After all users and groups have been added to this policy click on OK or APPLY in the Allow log on locally Properties window.

10. At the prompt type gpupdate /force to apply the policy.

Additional considerations

netdom trust trusting_domain_name /domain:trusted_domain_name /quarantine: {yes|no}