binding handles, since binding requires information from the
association and not from the binding handle.

ntdll: The impersonation level in NtDuplicateToken should be taken from the SecurityQualityOfService member of ObjectAttributes if present.

Some apps get a winproc as A and then set it again as W.