Get an Identity Level Token for a Windows User?

I want to create a WindowsIdentity for a given user. I don't need this for impersonation, just for checking group membership. I need it to work with and without a domain (none of these Kerberos S4U delegation delegates). The constructor for WindowsIdentity that uses the username seems to work for domain scenarios.

Is there any other way to get WindowsIdentity to do access checks? The best solution I have is to use DirectoryServices.AccountManagement to find the user, then list their groups.