Some AD users were added to the zone twice and the unix name of duplicated user entry is appended with “CNF:123….”. For example:
User UNIX name
John John CNF:123a3e2a5-1824-47c4-a0d6…
“CNF: <a hash number>” is appended by AD whenever it detects a conflict in the name for the newly created objects.
For example, there are two domain controllers, DC1 and DC2 in AD. A new user object called “John” is created on DC1 and immediately another new user object is created on DC2 with the same name “John”.
When DC1 and DC2 start to replicate, they will detect two conflicting objects. AD will rename the one created with the later timestamp by appending “CND:<GUID>” to its name. GUID is an unique identifier that is guaranteed to be unique and will prevent any future conflicts.
Simply delete the later object, i.e. the one which has “CNF:GUID” in UNIX name.