>This is all either detailed API or ADSI; both can handle this, as long as authentication as opposed to actually changing the current session's user context is the goal. ADSI can manipulate passwords through the IADsUser object's ChangePassword method; there's detailed C++ code in the MSDN library.
>
>Also check the topics IADsUser, IADsUser Property Methods, ADSI Error Codes in the library. It's on the Web somewhere on the MSDN site, but there's several hundred pages of docs. A good book on the topic is "ADSI ASP Programmer's Reference" from WROX Press - see the link in my .sig

Does ISAPI have anything to do with authorization? I've often wondered, " How would a local VFP client engage a particular server's ISAPI? Does the connect automatically start an ISAPI (if he's the guy?) session?". I'm still wondering <g>.