To impersonate a user the first thing you need is the security token of
that user and use WindowsIdentity.Impersonate () function that takes an
IntPtr (pointer) to that token.

To get the token you need to call the win32 api function LogonUser in
advapi32.dll. (see http://pinvoke.net/default.aspx/advapi32.LogonUser
for details and sample). Passing in the user name, domain and password
will authenticate the user and return a pointer to the security token,
which then can be used to call WindowsIdentity.Impersonate function.

(Be sure to wrap this entire operation in a try{}catch{}finally{}
block, and release the returned IntPtr in the catch block to avoid any
security issues... Also remember to revert back to the old identity
once your finished.)

Once the Impersonate function suceeds, your application is now using
the impersonated account's credentials. You can use the the new ACL
classes in .net 2.0 to programatically manage the ACL's of any NTFS
object. Link: http://west-wind.com/weblog/posts/4072.aspx

Hope this helps...