The question is not clear, imho. What is the environment of your site (intranet/Internet, open/closed registration etc.)?
Do you need to just "recognize" a user who comes back to your site after some time?
In this case, cookie with a GUID is probably just fine.
Or do you want to "recognize" users (from a previously known list) without them typing anything at all?
Then, a proper solution is to use either integrated authentication (provided that the users are in the domain, that is, your site must be intranet-only) or HTTPS with client authentication using SSL certificates (works for Internet as well).