Get identity-level token for Windows user?

I want to create a WindowsIdentity for a given user. I don't need it for impersonation, just for group membership checks. I need it to work with and without a domain开发者_StackOverflow社区 (none of that S4U Kerberos delegation stuff). The constructor for WindowsIdentity that takes a username only seems to work for domain scenarios.

Is there any other way I can get a WindowsIdentity to perform access checks? The best workaround I have is to use DirectoryServices.AccountManagement to find the user then enumerate their groups.