Hello.

I've got the following problem:

There is a web application (ASP.NET), that needs to
authenticate users against local machine and Active Directory.
By default, the application works as ASPNET account (Win2000, XP).
When working on ASPNET account the apllication is able to do the following:

    string path = "WinNT://" + Environment.MachineName + ",computer";
    DirectoryEntry entry = new DirectoryEntry(path, username, pwd);
    try
    {
    //force authentication
    Object o = entry.NativeGuid;

    //authentication succeeded

    }
    catch(...)
    {
    //authentication failed
    }

Wnen run as ASPNET account, the code is able to work correctly.
However, when run as SYSTEM account, exception is thrown

I need to switch to system account, because I also need to authenticate
users in Acitive Directory, and ASPNET this time cannnot connect to AD,
whereas SYSTEM account can.

So, currently I can authenticate users either in local system (when run as
ASPNET) or in AD (when run as SYSTEM), bot not concurrently (i.e.
I can not do this without restarting the process)

                SYSTEM     ASPNET
LOCAL USERS      -           +
DOMAIN USES      +           -

Questions:
1. Is there any way to grant local ASPNET account ability to connect to AD ?
2. Is there any way to allow SYSTEM account to authenticate users against
  local machine. (The inability seems ridiculous...)
  (Note: I cannot temporarily use impersonation [SYSTEM is granted right to
   impersonate someone elese] to check credentials, since the application is
   a muliti user system and the fraction of time the app would work as somebody
   else (not system but e.g John.Smith ) would leed to errors. Ok, I might
   lock entire application functionality when somebody performs logon
   but this would be hugely ineffective and would require to redesign
   plenty of code. (The application is pretty complex))

Thanks for help
Michał