ACROS identified a couple of instances where Microsoft’s code made impersonation calls in the wrong order during some permission-setting functions (this is a vastly simplified explanation) and by remedying those issues, the proof of concept code no longer worked.
