title: IIS Returning Old User Names to my application
body: <p>Here's my scenario.  I created an application which uses Integrated Windows Authentication in order to work.  In <code>Application_AuthenticateRequest()</code>, I use <code>HttpContext.Current.User.Identity</code> to get the current <code>WindowsPrincipal</code> of the user of my website.</p>
  
  <p>Now here's the funny part.  Some of our users have recently gotten married, and their names change.   (i.e. the user's NT Login changes from <code>jsmith</code> to <code>jjones</code>) and when my application authenticates them, IIS passes me their OLD LOGIN .  I continue to see <code>jsmith</code> passed to my application until I reboot my SERVER!  Logging off the client does not work.  Restarting the app pool does not work.  Only a full reboot.  </p>
  
  <p>Does anyone know what's going on here?  Is there some sort of command I can use to flush whatever cache is giving me this problem?  Is my server misconfigured?</p>
  
  <p>Note: I definitely do NOT want to restart IIS, my application pools, or the machine.  As this is a production box, these are not really viable options.</p>
  
  <hr>
  
  <p>AviD -</p>
  
  <p>Yes, their UPN was changed along with their login name.  And Mark/Nick... This is a production enterprise server... It can't just be rebooted or have IIS restarted.  </p>
  
  <hr>
  
  <p><strong>Follow up (for posterity):</strong></p>
  
  <p>Grhm's answer was spot-on.  This problem pops up in low-volume servers where you don't have a lot of people using your applications, but enough requests are made to keep the users' identity in the cache.  The key part of the <a href="http://support.microsoft.com/kb/946358" rel="noreferrer">KB</a> which seems to describe why the cache item is not refreshed after the default of 10 minutes is:</p>
  
  <blockquote>
    <p>The cache entries do time out, however chances are that recurring
    queries by applications keep the existing cache entry alive for the
    maximum lifetime of the cache entry.</p>
  </blockquote>
  
  <p>I'm not exactly sure what in our code was causing this (the recurring queries), but the resolution which worked for us was to cut the <code>LsaLookupCacheExpireTime</code> value from the seemingly obscene default of 1 week to just a few hours.  This, for us, cut the probability that a user would be impacted in the real world to essentially zero, and yet at the same time doesn't cause an extreme number of SID-Name lookups against our directory servers.  An even better solution IMO would be if applications looked up user information by SID instead of mapping user data to textual login name.  (Take note, vendors!  If you're relying on AD authentication in your application, you'll want to put the SID in your authentication database!)</p>