title: Check other user's role membership (IsInRole, WindowsIdentity/Principal)
body: <p>I'm writing ASP.NET code to run on an internal network where Windows Authentication will be used.  Certain operations will require me to run a group membership check on other users (not the current user)</p>
  
  <p>NOTE: I am NOT trying to impersonate this account, or access any information in the context of this other user.  Just trying to find out what kind of user they are for internal business logic.</p>
  
  <p>My first thought was to use </p>
  
  <pre><code>new WindowsPrincipal(new WindowsIdentity("MACHINENAME\\username"))
        .IsInRole("MACHINENAME\\Group1")
  </code></pre>
  
  <p>However, the WindowsIdentity constructor fails with a SecurityException "The name provided is not a properly formed account name".</p>
  
  <p>If I strip MACHINENAME\ from the parameter, I get a different error:  There are currently no logon servers available to service the logon request</p>
  
  <p><br /></p>
  
  <p>The WindowsTokenRoleProvider role provider explicitly only works with the current user, and will not check other user accounts.</p>
  
  <p>Are there security restrictions to checking roles of other users?  Would it make a difference if the web server was on a domain and I were checking domain accounts?</p>
  
  <p>In the end, I'll need to have this work on an AD domain, but would prefer a solution that will work on either local or AD accounts.</p>
  
  <p>Thank you</p>
  
  <p>UPDATE: I've been able to test this on a domain now -- the code does work in an AD context so long as I don't use the domain name (test "username" against "Group1", not "DOMAIN\username" against "DOMAIN\Group1")</p>
  
  <p>So how would I get this to work in the context of local users and groups?</p>