Thanks Nicholas,

I finally have it authenticating to the remote server (which is a great
relief, since the helpfile explicitly states that LogonUser can't provide
this functionality)

However I continue to get access denied when I try to instance the object. I
know the authentication code is working, because I replaced the COM code with
some code to copy a file, and it worked fine.

Here is the code I am currently using (apologies for the spam):

            IntPtr tokenHandle = new IntPtr(0);
            IntPtr dupeTokenHandle = new IntPtr(0);

            string userName = txtUserName.Text, domainName = txtDomain.Text, password
= txtPassword.Text;

            const int LOGON32_PROVIDER_WINNT50 = 3;
            const int LOGON32_LOGON_NEW_CREDENTIALS = 9;
           const int SecurityDelegation = 3;

            tokenHandle = IntPtr.Zero;
            dupeTokenHandle = IntPtr.Zero;

            // Call LogonUser to obtain a handle to an access token.
            bool returnValue = LogonUser(userName, domainName, password,
                LOGON32_LOGON_NEW_CREDENTIALS, LOGON32_PROVIDER_WINNT50, ref tokenHandle);

            if (returnValue == false)
            {
                int ret = Marshal.GetLastWin32Error();
                MessageBox.Show("LogonUser failed with error code : "+  ret.ToString() );
                MessageBox.Show("\nError: "+ ret.ToString() +" ,"+ GetErrorMessage(ret));
                int errorCode = 0x5; //ERROR_ACCESS_DENIED
                throw new System.ComponentModel.Win32Exception(errorCode);
                return;
            }

            MessageBox.Show("Did LogonUser Succeed? " + returnValue.ToString() );
            MessageBox.Show("Value of Windows NT token: " + tokenHandle.ToString() );

            bool retVal = DuplicateToken(tokenHandle, SecurityDelegation, ref
dupeTokenHandle);

            if (false == retVal)
            {
                CloseHandle(tokenHandle);
                Console.WriteLine("Exception thrown in trying to duplicate token.");    
 
                return;
            }

            //Impersonation.           
            MessageBox.Show("Before impersonation: " +
WindowsIdentity.GetCurrent().Name);

            WindowsIdentity newId = new WindowsIdentity(dupeTokenHandle);
            WindowsImpersonationContext impersonatedUser = newId.Impersonate();

            MessageBox.Show("After impersonation: " +
WindowsIdentity.GetCurrent().Name);

            Type t = Type.GetTypeFromProgID( "Microsoft.Update.Session",
txtDomain.Text );
               
            UpdateSession UpdSess = (UpdateSession) Activator.CreateInstance(t);
   
            IUpdateSearcher UpdSrch = UpdSess.CreateUpdateSearcher();
            ISearchResult sr = UpdSrch.Search("IsInstalled=0 and Type='Software'");
            MessageBox.Show( "Found "+ sr.Updates.Count.ToString() + " updates" );

            foreach( IUpdate temp in sr.Updates )
                MessageBox.Show( temp.Description.ToString() );           
       
            impersonatedUser.Undo();
         
            // Free the tokens.
            if (tokenHandle != IntPtr.Zero)
                CloseHandle(tokenHandle);

            if (dupeTokenHandle != IntPtr.Zero)
                CloseHandle(dupeTokenHandle);
            return;

The other strange thing I've noticed is that the 'after impersonation'
message still displays my local userid instead of the remote one. (Even when
the copy worked successfully).

In my searching, I've come across some references to a feature within COM
where it will ignore impersonated access. Does that apply here? If so, is
there a way to bypass it?