Posts across the web, and even the official MS Docs are pretty clear on the fact that when IIS has anonymous access enabled, the LOGON_USER variable is NEVER populated.
However, sometimes... it is.
Why?
When Anonymous Access is disabled, the LOGON_USER is always sent, but with Anonymous Access enabled, it usually doesn't send, even though it sends it some times (about 15% of the time in my experiments).
I've seen this behavior consistently between different configurations of IIS 5 and 6, running with servers and clients on Win2K, 2003, and XP, and using IE6-7-8.
Because of this behavior it's pretty obvious that using solely LOGON_USER for logic (say for naive single sign on implementations) is pretty unreliable.
So, just for curiousity's sake, why is everybody on the web adamant that LOGON_USER will never be populated with Anonymous Access enabled, and ...
Go to the complete details ...