Q:

Domain authentication failed for "domain\user"

I used the following code to perform authentication to AD server
using (var context = new PrincipalContext(ContextType. Domain))
{
     return context. ValidateCredentials(samAccountName, password. RetrieveString()
                                               , ContextOptions. Negotiate);
}

The thing is, it will only work if I use "user@domain.com", it will not work if I use "domain\user". 
Any idea why? 

A:

For Kerberos to work, you need to do 'user@domain' if the user is not currently logged into that domain.  If logged into the domain, "domain\user" should work. 
This is my experience on our Kerberos network.