title: Strange Error When Using System.DirectoryServices.AccountManagement.PrincipalContext.ValidateCredentials with SAM
body: <p>I am hosting a WCF Web Service with IIS 6.0. My application pool is running under a local Administrator account, and I have other local users defined for accessing the Web Service. I've written the following code to validate users:</p>
  
  <pre><code>
  //Any public static (Shared in Visual Basic) members of this type are thread safe
  public static PrincipalContext vpc;
  
  //static initializer
  static UserManagement()
  {
      vpc = new PrincipalContext(ContextType.Machine);
  }
  
  //Determines whether the given credentials are for a valid Administrator
  public static bool validateAdminCredentials(string username, string password)
  {
      using (PrincipalContext principalContext = new PrincipalContext(ContextType.Machine))
      {
          if (vpc.ValidateCredentials(username, password))
          {
              using (UserPrincipal user = UserPrincipal.FindByIdentity(principalContext, IdentityType.SamAccountName, username))
              {
                  foreach (GroupPrincipal gp in user.GetGroups())
                  {
                      try
                      {
                          if (gp.Name.Equals("Administrators"))
                          {
                              return true;
                          }
                      }
                      finally
                      {
                          gp.Dispose();
                      }
                  }
              }
          }
  
          return false;
      } //end using PrincipalContext
  }
  </code></pre>
  
  <p>...and in another class:</p>
  
  <pre><code>
  //verify the user's password
  if (!UserManagement.vpc.ValidateCredentials(username, password))
  {
      string errorMsg = string.Format("Invalid credentials received for user '{0}'", username);
      throw new Exception(errorMsg);
  }
  </code></pre>
  
  <p>(Note: I am using the public static PrincipalContext (vpc) solely for calling the ValidateCredentials method; I create a different, temporary PrincipalContext for creating, deleting, and finding users and groups, as I got various COM-related errors when I tried using the global PrincipalContext for everything).</p>
  
  <p>So, most of the time, this code works wonderfully. However, intermittently, I get the following error:</p>
  
  <p>Multiple connections to a server or shared resource by the same user, using more than one user name, are not allowed. Disconnect all previous connections to the server or shared resource and try again. (Exception from HRESULT: 0x800704C3)</p>
  
  <p>Application:
  System.DirectoryServices.AccountManagement</p>
  
  <p>Stack Trace:
  at System.DirectoryServices.AccountManagement.CredentialValidator.BindSam(String target, String userName, String password)
  at System.DirectoryServices.AccountManagement.CredentialValidator.Validate(String userName, String password)
  at System.DirectoryServices.AccountManagement.PrincipalContext.ValidateCredentials(String userName, String password)
  at MyNamespace.User..ctor(String username, String password)</p>
  
  <p>Once the error occurs, I continue to get it until I restart my entire server (not just IIS). I've tried restarting my application pool and/or IIS, but the error does not go away until I restart the machine. I've also tried instantiating (via a using block) a new PrincipalContext for every call to ValidateCredentials (which I shouldn't have to do), but I still eventually get the same error. From what I've read on System.DirectoryServices.AccountManagement (msdn docs, articles), I believe I'm using it correctly, but this error is crippling my application! I need (and should be able) to validate local user credentials from web service requests coming from multiple clients. Am I doing something wrong? Any help on solving this issue would be much appreciated...</p>