Colin Angus Mackay wrote: That doesn't sound right to me. It should be "machine\user" or "domain\user" (the former is prefered because then the account is local only to the machine). The user's credentials passed from the browser make it to the web server, but can't get passed to the database server, there is a one hop limit when passing credentials. So when connecting, then, from the web server to the database server, the credentials from the aspnet process are used instead. Because 'machine' is specified in the machine.config processModel element, domain\machine$ is sent to the database server. If identity impersonate="true" is placed in the web.config file, aspnet pretends it is running as the user. But authentication on the db server fails because 'null' is passed instead of the user's. 'null is passed because of the one hop limit. If the web server and db server are the same server, then the one hop limit is satisfied and you can use identity impersonate="true" successfully. This however goes against MS recommendations when architecting a web app.