CreateRestrictedToken

function CreateRestrictedToken(

  ExistingTokenHandle: HANDLE;

  Flags: DWORD;

  DisableSidCount: DWORD;

  SidsToDisable: PSID_AND_ATTRIBUTES;

  DeletePrivilegeCount: DWORD;

  PrivilegesToDelete: PLUID_AND_ATTRIBUTES;

  RestrictedSidCount: DWORD;

  SidsToRestrict: PSID_AND_ATTRIBUTES;

  var NewTokenHandle: HANDLE

):BOOL;