>Hi Viv, I like the sound of the email account verification, but for Windows authentication would you create users on the server hosting the website that match the user on the client ? Sorry I haven't done much web stuff

Yup - for Windows authentication you would need users on the web server (or the domain) for each client - can become a bit unwieldy if there are a lot of users. Upside is that a system admin can control UA without anything special in the app itself...