WindowsTokenRoleProvider Class

Gets role information for an ASP.NET application from Windows group membership.

Namespace: System.Web.Security
Assembly: System.Web (in system.web.dll)

public class WindowsTokenRoleProvider : RoleProvider
public class WindowsTokenRoleProvider extends RoleProvider
public class WindowsTokenRoleProvider extends RoleProvider
Not applicable.

The WindowsTokenRoleProvider class is a read-only role-membership provider that retrieves role information for a Windows user based on Windows security groups. It is most useful with ASP.NET applications that use Windows authentication mode where the IIS authentication settings disable anonymous authentication. You can configure ASP.NET applications to allow or deny access based on a user's membership in a particular Windows group.

You cannot use the WindowsTokenRoleProvider class to create or delete roles or modify the membership of a role that is based on Windows group membership. This functionality is managed by the Windows operating system. The WindowsTokenRoleProvider class supports only the IsUserInRole and GetUsersInRole methods of the RoleProvider abstract class.

The following example shows the Web.config file for an ASP.NET application. It specifies that the application uses both Windows authentication and the WindowsTokenRoleProvider class to retrieve role information for Windows users. The authorization element specifies that only users in the BUILTIN\Administrators group are allowed access to the application.

    <authentication mode="Windows" />

      <allow roles="BUILTIN\Administrators" />
        <deny users="*" />

    <roleManager defaultProvider="WindowsProvider" 
          type="System.Web.Security.WindowsTokenRoleProvider" />


  • AspNetHostingPermission  for operating in a hosted environment. Demand value: LinkDemand; Permission value: Minimal.
  • AspNetHostingPermission  for operating in a hosted environment. Demand value: InheritanceDemand; Permission value: Minimal.


Any public static (Shared in Visual Basic) members of this type are thread safe. Any instance members are not guaranteed to be thread safe.

Windows 98, Windows Server 2000 SP4, Windows Server 2003, Windows XP Media Center Edition, Windows XP Professional x64 Edition, Windows XP SP2, Windows XP Starter Edition

The Microsoft .NET Framework 3.0 is supported on Windows Vista, Microsoft Windows XP SP2, and Windows Server 2003 SP1.

.NET Framework

Supported in: 3.0, 2.0