>Is it possible for a COM object to programatically authenticate to NT using username and password from an IIS session object?

Yes. Check out Rick Strahl's wwIPStuff utilities on his web site (www.west-wind.com). It uses the CreateProcessAsUser and LogonUser API functions to do this. In order for this to work, the creating user must have permission to act as part of the OS. Because the IIS internal user does, this technique works.

HTH.