Rob Shearman : secur32: NTLM's AcquireCredentialHandleA/ W should accept domains and usernames with lengths of 0.