http://ayende.comAyende @ RahienCopyright (C) Ayende Rahien 2004 - 2021 (c) 202660You'll likely want to stick with AD, LogonUser is not really meant to be used across unrelated domains (and the reason you can't get other login types possibly has to do with the privileges granted to the target account). There are a few gotchas to watch out for, though: 1- The above sample leaks resources like the plague. 2- Try to cache data if needed, hitting ADS is _slow_ 3- Be very careful about using it in a high volume scenario. I once got into a situation where we hit AD using similar code very heavily (we had 700+ concurrent users) and the AD code would at random times cause massive deadlocks that completely brought a COM+ application to its knees. We spent more than a month with PSS trying to diagnose the issue and they never were able to tell us exactly what was causing the deadlock, though apparently something nasty was going on at a very low level (apparently the client was never catching some responses from the server or something like that). Needless to say, they weren't very happy about having to look at memory dumps with 700 frozen threads :) http://ayende.com/2069/public-code-review#comment2http://ayende.com/2069/public-code-review#comment2Mon, 05 Feb 2007 03:55:42 GMTYou must stick with AD approach. Otherwise if you use LogonUser all your requests would goes back to the PDC Emulator for processing- very bad in a bigger distributed domain environment. The directory service way to access information are usually quite cryptic, but too bad it seems is the only way to access AD in .net too. http://ayende.com/2069/public-code-review#comment1http://ayende.com/2069/public-code-review#comment1Mon, 05 Feb 2007 01:12:03 GMT