work harder to maybe fix #5574. this cleans up some handles after using them, and doesn't disable ALL process privileges upon success