binding handles, since binding requires information from the
association and not from the binding handle.

ntdll: The impersonation level in NtDuplicateToken should be taken from the SecurityQualityOfService member of ObjectAttributes if present.