title: Windows authentication inconsistencies with "LOGON_USER" server variable
body: <p>Another developer and I are both working on the same ASP.NET web app. The application uses Forms authentication, but the IIS virtual directory is configured with both "anonymous access" and "integrated Windows authentication". This mirrors the production site which authenticates as required.</p>
  
  <p>A potentially key difference between our two setups is that he is on Windows 7 and IIS 7, whereas I'm on Windows XP and IIS 5 (for my sins).</p>
  
  <p>Initially when we both run the app, the variable... <pre>HttpContext.Current.User.Identity.IsAuthenticated</pre> ...is false. This I'd expect because we're configured with Forms authentication. The app then redirects to a WindowsAuth.aspx page. That page checks the Request.ServerVariables["LOGON_USER"] server variable and, if this isn't null or empty, uses it to automatically sign in.</p>
  
  <p>The issue is, on my PC Request.ServerVariables["LOGON_USER"] is always empty. To me this is correct since we have anonymous access enabled. But on my colleague's PC, and in production, the variable holds the user's username. I cannot understand why this is. Is there a difference between IIS 5 and 7 in this regard? Otherwise, can you explain this? Obviously I want my setup to reflect other environments but upgrading to Windows 7 is a last resort at this point.</p>