Would be great to clarify this comment more to make it clear why the LogonUser itself is necessary in this case -- basically the interactive user gets access denied trying to do logonuser, correct?