It's almost certainly not a Gina thing at all. LogonUser API call requires SE_CHANGE_NOTIFY_NAME privillege to work. Get your dev guy's to read this article at MSDN as it's probably down to the way they are calling the API in the first place ! When you say they can call the API when in an RDP session but not an ICA session is this with the same user account to the same physical server, ie. RDP and ICA to a single Terminal Server ? Mark ________________________________ From: thin-bounce@xxxxxxxxxxxxx on behalf of thinlist@xxxxxxxxx Sent: Wed 2/22/2006 10:59 AM To: thin@xxxxxxxxxxxxx Subject: [THIN] Re: Looking for ways to verify an Active Directory user and passw ord to access app running on Citrix which at the moment uses it's own int ernal authentication May have something to do with the gina, citrix replaces the msgina with ctxgina, this *maybe* related, you might want to see if ctxgina implements this function. On 2/14/06, Steve Parr <sparr@xxxxxxxxxxxxx> wrote: Should have added that we use regular Program Neighbourhood ICA clients v. 7.1. No PN Agent or web clients in use. -----Original Message----- From: Steve Parr Sent: Tuesday, February 14, 2006 4:45 PM To: 'thin@xxxxxxxxxxxxx' Subject: Looking for ways to verify an Active Directory user and password to access app running on Citrix which at the moment uses it's own internal authentication One of the developers in our IT group is currently looking for ways to verify an Active Directory user and password from within one of the applications running here. He has found a way to do this using the LogonUser API call. However, while this method works when connected to any computer using RDP, this method always fails when connected to a Citrix server. Without having to consult the Citrix SDK as we do not have a copy does anyone know what API\dll's will do the trick if we are running Mteaframe XP FR3? Steve Parr Metroland Printing, Publishing and Distributing Ltd.