Yes I knew that, and I've done that in the past, but it's not an option in this case. The new database server is on a completely separate subdomain which (for security reasons) does not communicate with the Windows AD domain that the users are coming from.