Thanks that actually did explain the problem! You can't do this with win2k. It is an adminmisc problem. Man I do wish Dave had time to maintain it.

LOGON32_LOGON_NETWORK_CLEARTEXT Windows 2000/XP: This logon type preserves the name and password in the authentication packages, allowing the server to make connections to other network servers while impersonating the client. This allows a server to accept clear text credentials from a client, call LogonUser, verify that the user can access the system across the network, and still communicate with other servers.

LOGON32_LOGON_NEW_CREDENTIALS Windows 2000/XP: This logon type allows the caller to clone its current token and specify new credentials for outbound connections. The new logon session has the same local identity, but uses different credentials for other network connections. This logon type is supported only by the LOGON32_PROVIDER_WINNT50 logon provider.

Shoot. I will have to firgure out another method!