title: Can Windows Integrated Authentication be used to verify a $MachineName when initiated from a Windows Service?
body: <p>I have a service account that communicates with a Web Service over HTTPS. I need to verify the calling machine name at the server, and deliver a response that includes this.</p>
  
  <p>In my scenario, it's a security risk for the machine to specify its name in the request due to spoofing (e.g. <code>https://internal.com/GetSoftware?machine=host123</code>)</p>
  
  <p><strong>Question</strong></p>
  
  <ol>
  <li>Assuming that host123 is domain joined, how can a Windows Service pass along proof that it's domain-joined and prove that the machine name is indeed <code>host123</code>?</li>
  </ol>
  
  <p><strong>Similar scenarios</strong></p>
  
  <p>Scenarios like this are already in use in:</p>
  
  <ul>
  <li><p>AD DNS, where machines have permission to publish and update their records, albeit over a non HTTPS port.  </p></li>
  <li><p>Integrated windows authentication to an IIS based webserver, a Microsoft specific challenge response is issued, and a browser like IE would step in and handle including the user token in the response.</p></li>
  </ul>
  
  <p>I would like to make a similar connection that IE does with IIS for integrated authentication, but for the $machinename.</p>
  
  <p>What approaches should I explore?</p>