On of the top benefits to using NetNamedPipeBinding is that we provide an on-box guarantee for your messages. The on-box guarantee is enforced by Denying the Network Security Identifier (SID: S-1-5-2) access to our named pipe. This is the most secure, safest way of ensuring that you are not exposed to connection attempts from the network.
There is a price to pay for this assurance, and it comes in the form of impersonation support in middle-tier scenarios. The short version is that if you are using impersonation, you can only perform messaging to another Named Pipe endpoint using that impersonated token if you negotiate to NTLM in certain restricted conditions.
Here are the gory details:
Over Kerberos, any client/server authentication will always generate Network SID in the access token. When the server authenticates a client all the relevant information is included in the Kerberos ticket presented by the client, and the ticket doesn’t contain information on the location of the client (this is simply not part of the protocol at this point). So even if both client and server are on the same machine, everything works exactly the same as in the remote case, and the resulting access token has the Network SID (because the protocol has no way of knowing that you are on-box).
Over NTLM, if the client uses the current credentials there is an optimization where NTLM references the existing token under which the client process is running instead of generating a new token. In this case you won’t see the Network SID, because the original token was generated by an interactive logon attempt. If your client is configured with specific credentials, then SSPI will consider this a network logon.
When using WCF, Windows authentication is performed through SSPI-Negotiate, which in most cases will select Kerberos as the actual authentication mechanism. However, if the target SPN passed to SSPI is a well formed SPN for the local computer account (e.g. host/[dns machine name]) then Negotiate will use NTLM (loopback optimization) and the access token will not have the Network SID (and therefore will be usable with NetNamedPipes).
After a long hiatus, I’ve now had three crêpes in the past month. The latest was this afternoon at The 
When Lauren takes me to Berkeley, there are two must haves on the “Eat Berkeley” tour. Both are right near campus, quick, cheap, and yummy. The first is Crêpes A-Go-Go — a little place that serves (as you might expect) lots of crêpes. The savory crêpes make for a great breakfast, light lunch, or snack. Lauren is showing off the “house special” (turkey, spinach, egg, and swiss). When ordering an egg crêpe you should know that the eggs aren’t scrambled, they’re fried (with the yolk cooked in the middle of the white). It was yummy, but next time I’ll ditch the egg and stick with turkey (or spinach), mushroom and cheese.
They also have perfect choices for satisfying your sweet tooth, such as the chocolate & fresh strawberries crêpe that 
The café is a la carte, louder and livelier, and has a lot more seating available. Chez Panisse is owned by the famous chef 
In the café the tables are very close together, which means that it’s very easy to eavesdrop on your neighbors’ conversations and to spy on their food (not that 
Lauren ordered the hand-cut pasta with North Carolina white shrimp and mustard blossoms. The pasta was soft and the shrimp tender. There was a breadcrumb-like crust atop the pasta which reminded me of comfort food, though it was much lighter than your traditional casserole. Along with the main course we tried the “Chez Panisse Zinfindel”.
The “crêpe place” is the 
