Workgroups, domains and LogonUser

I'm having a problem and I'm wondering if this is a configuration issue, or a bug in my code, or something that just isn't possible. I have an application which runs on a server which is part of a workgroup. In my application, I make the following call to the Win32 method LogonUser

LogonUser(<user name>, <domain name>, <password>, LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, <new token address>)

I pass it valid credentials for an existing domain user account. LogonUser() fails with error code 1326: "Logon failure: unknown user name or bad password".

I assume this is failing because the server in the workgroup has no knowledge of the domain and the domain account. Is there a way, via a workgroup config setting or programatically, so that the workgroup knows that this is a domain account and it should authenticate against a domain controller?

By default the machine in the workgroup will not pass the credentials
to the DC for authentication instead it will check it's local SAM
database.
You can verify this by specifying a local account. Can you by chance
join the machine to the domain?

"Masaki Tamaoki" <(E-Mail Removed)> wrote in message
> I'm having a problem and I'm wondering if this is a configuration
issue, or a bug in my code, or something that just isn't possible. I
have an application which runs on a server which is part of a workgroup.
In my application, I make the following call to the Win32 method
LogonUser
>
> LogonUser(<user name>, <domain name>, <password>,
LOGON32_LOGON_INTERACTIVE, LOGON32_PROVIDER_DEFAULT, <new token
address>)
>
> I pass it valid credentials for an existing domain user account.
LogonUser() fails with error code 1326: "Logon failure: unknown user
name or bad password".
>
> I assume this is failing because the server in the workgroup has no
knowledge of the domain and the domain account. Is there a way, via a
workgroup config setting or programatically, so that the workgroup knows
that this is a domain account and it should authenticate against a
domain controller?

No, unfortunately, the machine cannot be added to the domain.

And yes, I did verify this behavior by specifying a local account.

Do you know the correct way to accomplish what I am trying to do?

I have a web server application that is attempting to access files on a network file share. For security purposes, we limit access to the file share to a specific domain account. As stated in my earlier message, we call LogonUser() with the domain credentials to get a token to access the file share. It appears that this won't work when the web server is part of a workgroup.