how to make regex for windows forms

What you want would be hard, if not impossible, to do with regular expressions, but there is one way you could pull this through if you can agree to separate the length check from the regular expression stuff. First check would be if the length of the username is within the specified bounds and if it is check the username with this here regex:

^(?:[a-zA-Z0-9](?:\.|_|-)?)+[a-zA-Z0-9]$

Regards,

— Manfred

Modified: I had to change the capturing parenthesis () to non capturing (?: ... ) and now it works like a charm.

OK, I've now worked out how to do it almost perfectly. For explanation purposes I've split the expression into three lines, but if you will use it it will have to written in one line like below:

(?!^[a-zA-Z0-9\.\-_]{1,2}$)(?!^[a-zA-Z0-9\.\-_]{16,}$)(?!^[0-9]{3,15}$)^(?:[a-zA-Z0-9](?:\.|_|-)?)+[a-zA-Z0-9]$

Explanation:
There is a grouping operator for regular expressions that is called zero-width negative lookahead (?! < subexpression >). What does that mean? Let's dissect this monster description:

1. Zero-width lookahead
   This essentially means that this matching expression will not consume any characters. So when this expression has matched any following non zero-width expression will start of at the same place in the string as the zero-width regular expression did.
2. Negative
   This signifies that all following expressions can only match, if this expression did not previously produce any matches.

(?!^[a-zA-Z0-9\.\-_]{1,2}$) // This expression will assert that a username with characters a-z A-Z 0-9 . _ and - is no less than three characters long
(?!^[a-zA-Z0-9\.\-_]{16,}$) // This expression will assert that a username with characters a-z A-Z 0-9 . _ and - is no longer than 15 characters
(?!^[0-9]{3,15}$)           // This expression will assert that a username will not be made up of only digits [0-9]
^(?:[a-zA-Z0-9](?:\.|_|-)?)+[a-zA-Z0-9]$

Given the three assertions at the beginning of the regular expression we can now be sure that there are at least 3 characters and no more than 15 and that a username of only digits is also disallowed. The ^ and $ in the assertions are important here.

Now lets have a look at the final part which is also broken into several lines to better annotate it:

^                // Start match at the beginning to the string
(?:[a-zA-Z0-9]   // Make sure that a username will not start with a '.' a '-' or a '_', but only alphanumeric characters
    (?:\.|_|-)?  // After an initial alpha numeric a '.' a '-' or a '_' may follow, but not two in a row ...
)+               // ... so we repeat this pattern once or many times (+). Drawback: ._ .- _- etc. are also not allowed, which I think we can live with here.
[a-zA-Z0-9]      // Finally we make sure that there is an alphanumeric character in the last position ...
$                // ... exactly at the end of the string.

I do hope you could follow my explanations and found this solution helpful. The only drop of bitternes to me is that we now have an additional constraint:
While it is true that the each of the characters '.', '-' and '_' may appear no more than once in row (valid constraint from OP), but now none of the characters in the class [\.\-_] can appear one after another (new constraint introduced through solution).

Regards,

— Manfred