CreateProcessWithLogonW from SYSTEM

I've gotten a few reports from people that CPWLW is failing when run as SYSTEM. I confirmed this myself on Friday when I was hacking up some code for a client. Today I looked and found this in the docs:

Windows XP SP2 and Windows Server 2003:  You cannot call CreateProcessWithLogonW from a process running under the LocalSystem account. This is because the function uses the logon SID in the caller token and the token for the LocalSystem account does not contain this SID. As an alternative, use the CreateProcessAsUser and LogonUser functions.

When I first read this, I figured it was referring to the logon SID of the new logon, which is typically used to add a grant in the DACL of the winsta / desktop pair where the new process will live. But now that I reread it, clearly it's referring to the caller's logon SID. I wonder what that could be used for? Securing some temporary object used for communicating between the caller's process and the secondary logon service? Inquiring minds want to know, in case any of my MS readers were involved with this change.

In any case, if you're running your service as SYSTEM (tsk tsk tsk) and you want to migrate to W2K3 and XP SP2, I hope you're not calling CreateProcessWithLogonW. If you are and need another way, check out my 5 year old article (wow, has it been that long?) on doing this the old way using LogonUser / CreateProcessAsUser, etc. Note that since the article was released, (Un)LoadUserProfile was documented. So be sure to use that API instead of the rather complicated approach to bootstrapping the user's environment that I had to follow back in 1999.

The article comes with a tool called cmdasuser.exe from which you can grab all the code you need to get this going.