using sspi (ntlm) api's windows accesscheck() perspective uac

summary
client (windows xp sp3)
server (windows perspective business sp1) / controlling localsystem use

api method
client - acquirecredentialshandle
client - initializesecuritycontext
server - acquirecredentialshandle
server - acceptsecuritycontext
client/server - completeauthntoken
server - impersonatesecuritycontext
server - accesscheckandauditalarm (maximum_allowed)
server - i following review opening requested certified accesses.

i opening check opposing private confidence vigilant combined createprivateobjectsecurityex. uac incited i success behind accesscheck, nonetheless zero privledges held. uac incited off i success behind rights gantedaccess parameter

details
the concentration twin componets it, fan server.
uses tcp communicat over an unsecured network. authentication
the incomming connectors i sspi api's listed above,
impersonate job user. once job user impersonated i
use accesscheckandauditalarm, fails i return behind only
accesscheck. uac incited i am removing success behind
accesscheckandauditalarm nonetheless zero opening rights
grandedaccess paramter, nonetheless uac incited off works expected.
i have check trust turn server slight set
to high, i have looked trust turn impersonation token
used burlesque job user set medium. i have
tried sourroundings trust turn job user high,
success nonetheless opening check still advantage incorrrect results.
thinking i competence have related token i attempted related token
call gettokeninformation(tokenlinkedtoken) outcome 0x520.
any thoughts i competence try unbroken appreciated.

code after authentication.

security_status ss = sec_e_ok; 
 hoop _htoken = null; 
 ss = querysecuritycontexttoken((pctxthandle)pcontext,&_htoken); 
 if(sec_e_ok != ss) 
 { 
  relapse ss; 
 } 
 caccesstoken imptoken; 
 imptoken.attach(_htoken); 
 if(cwin32::isvista()) 
 { 
  /*token_linked_token linkedtoken; 
  dword nlen = 0; 
  bool bret = gettokeninformation(_htoken, 
(token_information_class)tokenlinkedtoken,&linkedtoken,sizeof(linkedtoken), &nlen); 
  if(bret) 
  { 
   closehandle(imptoken.detach()); 
   imptoken.attach(linkedtoken.linkedtoken); 
  } 
  else 
  { 
   trace(_t("gettokeninfo unsuccessful 0x%x\n"),getlasterror()); 
  }*/ 
  psid    phighintegritysid = null; 
  bool bconvertsid = false; 
  bconvertsid = convertstringsidtosid(sddl_ml_high, 
&phighintegritysid); 
  (bconvertsid) 
  { 
   token_mandatory_label tml = {0}; 
   tml.label.attributes = se_group_integrity | 
se_group_integrity_enabled; 
   tml.label.sid        = phighintegritysid; 
   bool bsettokenret = settokeninformation(_htoken, 
(token_information_class)tokenintegritylevel,&tml,sizeof(tml) + 
getlengthsid(phighintegritysid)); 
   localfree(phighintegritysid); 
   if(!bsettokenret) 
   { 
    nreturn = getlasterror(); 
    dbgout(debugout::log_comp_auth_layer,debugout::log_detail_error, 
     _t("failed set token information %x\n"),nreturn); 
    relapse nreturn; 
   } 
  } 
 } 
 bool bret = imptoken.impersonate(); 
 if(false == bret) 
 { 
  relapse getlasterror(); 
 } 
 _gettokensecuritylevel(imptoken.gethandle()); 
 ::mapgenericmask(&nrights, getgeneric_mapping()); 
 dword naccessgranted = 0; 
 bool baccessstatus = false; 
 bool bgenerateonclose = false; 
 bool baccesscheckret = false; 
 baccesscheckret = ::accesscheckandauditalarm(_t("purgos 
security"),imptoken.gethandle(),_t("purgos"),m_csobjectname.getbuffer(0), 
const_cast<security_descriptor*>(m_objectsd.getpsecurity_descriptor())/ 
*privobjectsd.getpsecurity_descriptor())*/,maximum_allowed,getgeneric_mappi ng(),false,&naccessgranted,&baccessstatus,&bgenerateonclose);