Brian I see value there, however, unless you can change the owner of the process to be the current user, that process will run under the context of the user who's id was used to logon and impersonate.
This can be demonstrated by executing "cmd /c start /w winword.exe"
The problem here is that whatever you launch runs under the context of an admin's ID and potentially a Domain Admin. This can be demonstrated by logging on the remote box as a non-admin and running the remote execute with cmd /k as the process. I think that will allow the non-admin interactive access to the DOS window under your context, thereby allowing them admin access to any server.
_________________________
-Jim
...the sort of general malaise that only the genius possess and the insane lament.
