Как узнать SID процесса, для того чтобы понять системный процесс или нет и от имени какого пользователя он запущен

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ProcessStartTime As Any, pProcessUserSid As Any, dwSidSize As Long) As Long

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ByVal ProcessStartTime As Currency, pProcessUserSid As Any, dwSidSize As Long) As Byte

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ByVal ProcessStartTime As Currency, pProcessUserSid As Any, dwSidSize As Long) As Long
Private Declare Function GetProcessTimes Lib "kernel32" (ByVal hProcess As Long, lpCreationTime As Currency, lpExitTime As Currency, lpKernelTime As Currency, lpUserTime As Currency) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function LookupAccountSidA Lib "advapi32.dll" (ByVal lpSystemName As Any, ByVal sid As Long, ByVal name As String, cbName As Long, ByVal ReferencedDomainName As String, cbReferencedDomainName As Long, peUse As Long) As Long
 
Private Sub Form_Load()
    Dim MyPid As Long
    Dim timZero As Currency ' Не интересуемые нами времена, но обязательные к заполнению в функции GetProcessTimes
    Dim tim As Currency
    Dim sid() As Byte
    Dim ret As Long
    Dim lpszDomain As String, lpszUsername As String, cbDomain As Long, cbUsername As Long
    Dim k As Long
    Dim ReturnValue As Long
    Dim lpSid As Long
    
    MyPid = GetCurrentProcessId
    GetProcessTimes -1, tim, timZero, timZero, timZero ' Получить время запуска текущего процесса
    
    ReDim Preserve sid(0)
    ReturnValue = WinStationGetProcessSid(ByVal 0&, MyPid, tim, sid(0), ret)
    ' Почему-то у меня функция WinStationGetProcessSid возвращает всё время разные числа
    
    Print "ReturnValue: " & ReturnValue
    
    If ret > 0 Then
        ReDim Preserve sid(ret - 1)
        WinStationGetProcessSid ByVal 0&, MyPid, tim, sid(0), ret
        
        lpSid = VarPtr(sid(0))
        
        cbDomain = 260: cbUsername = 260: lpszDomain = String(cbDomain, 0): lpszUsername = String(cbUsername, 0)
        If LookupAccountSidA(0&, lpSid, lpszUsername, cbUsername, lpszDomain, cbDomain, k) <> 0 Then
            lpszDomain = Left(lpszDomain, cbDomain)
            lpszUsername = Left(lpszUsername, cbUsername)
        Else
            lpszDomain = "<Unknown>"
            lpszUsername = "<Unknown>"
        End If
        
        Print Chr(34) & lpszDomain & "\" & lpszUsername & Chr(34)
        Print ReturnValue ' Почему-то у меня функция WinStationGetProcessSid возвращает всё время разные числа
    End If
End Sub

Private Declare Function WinStationGetProcessSid Lib "winsta.dll" (ByVal hServer As Long, ByVal ProcessId As Long, ByVal ProcessStartTime As Currency, pProcessUserSid As Any, dwSidSize As Long) As Byte
Private Declare Function GetProcessTimes Lib "kernel32" (ByVal hProcess As Long, lpCreationTime As Currency, lpExitTime As Currency, lpKernelTime As Currency, lpUserTime As Currency) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function LookupAccountSidA Lib "advapi32.dll" (ByVal lpSystemName As Any, ByVal sid As Long, ByVal name As String, cbName As Long, ByVal ReferencedDomainName As String, cbReferencedDomainName As Long, peUse As Long) As Long
 
Private Sub Form_Load()
    Dim MyPid As Long
    Dim tim As Currency
    Dim sid() As Byte
    Dim ret As Long
    Dim lpszDomain As String, lpszUsername As String, cbDomain As Long, cbUsername As Long
    Dim k As Long
    Dim ReturnValue As Long
    Dim lpSid As Long
    
    MyPid = GetCurrentProcessId
    GetProcessTimes -1, tim, 0, 0, 0
    
    ReDim Preserve sid(0)
    ReturnValue = WinStationGetProcessSid(ByVal 0&, MyPid, tim, sid(0), ret)
    Print "ReturnValue1: " & ReturnValue
    
    If ret > 0 Then
    
        ReDim Preserve sid(ret - 1)
        ReturnValue = WinStationGetProcessSid(ByVal 0&, MyPid, tim, sid(0), ret)
        Print "ReturnValue2: " & ReturnValue
        
        lpSid = VarPtr(sid(0))
        
        cbDomain = 260: cbUsername = 260: lpszDomain = String(cbDomain, 0): lpszUsername = String(cbUsername, 0)
        
        If LookupAccountSidA(0&, lpSid, lpszUsername, cbUsername, lpszDomain, cbDomain, k) <> 0 Then
            lpszDomain = Left(lpszDomain, cbDomain)
            lpszUsername = Left(lpszUsername, cbUsername)
        Else
            lpszDomain = "<Unknown>"
            lpszUsername = "<Unknown>"
        End If
        
        Print Chr(34) & lpszDomain & "\" & lpszUsername & Chr(34)
 
    End If
End Sub

Option Explicit
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Function OpenProcessToken Lib "advapi32.dll" (ByVal ProcessHandle As Long, ByVal DesiredAccess As Long, TokenHandle As Long) As Long
Private Declare Function GetTokenInformation Lib "advapi32.dll" (ByVal TokenHandle As Long, ByVal TokenInformationClass As Long, TokenInformation As Any, ByVal TokenInformationLength As Long, ReturnLength As Long) As Long
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Private Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Private Declare Function GetMem4 Lib "msvbvm60" (ByVal Addr As Long, ByRef dstValue As Long) As Long
Private Declare Function ConvertSidToStringSid Lib "advapi32.dll" Alias "ConvertSidToStringSidW" (ByVal lpSid As Long, lpString As Long) As Long
Private Declare Function lstrlen Lib "kernel32" Alias "lstrlenW" (ByVal lpString As Long) As Long
Private Declare Function lstrcpy Lib "kernel32" Alias "lstrcpyW" (ByVal lpString1 As Long, ByVal lpString2 As Long) As Long
Private Declare Function LocalFree Lib "kernel32" (ByVal hMem As Long) As Long
 
Private Const PROCESS_ALL_ACCESS = 2035711
Private Const TOKEN_QUERY = &H8
Private Const MAX_PATH As Long = 260
 
' Узнать системный ли это процесс (работает как с админ прававми, так и без)
Public Function IsSystemProcess(pid As Long) As Boolean
    Dim hProc As Long
    Dim hToken As Long
    Dim lNeeded As Long
    Dim buffer() As Byte
    Dim lpSid As Long
    Dim lpString As Long
    Dim sBuffer As String
    
    hProc = OpenProcess(PROCESS_ALL_ACCESS, 0, pid)
    
    If hProc > 0 Then
        If OpenProcessToken(hProc, TOKEN_QUERY, hToken) > 0 Then
            GetTokenInformation hToken, 1, ByVal 0&, ByVal 0&, lNeeded
            ReDim Preserve buffer(lNeeded - 1)
            
            If GetTokenInformation(hToken, 1, buffer(0), lNeeded, lNeeded) > 0 Then
                GetMem4 VarPtr(buffer(0)), lpSid
                
                If ConvertSidToStringSid(lpSid, lpString) Then
                    sBuffer = Space$(lstrlen(lpString))
                    lstrcpy StrPtr(sBuffer), lpString
                    LocalFree lpString
                End If
                
                If Len(sBuffer) > 0 Then
                    If Mid$(sBuffer, 7, 2) = "21" Then ' Если это обычный пользователь
                        IsSystemProcess = False
                    Else
                        IsSystemProcess = True
                    End If
                End If
            End If
            
            CloseHandle hToken
        Else
            IsSystemProcess = True
        End If
        
        CloseHandle hProc
    Else ' Если процесс не открылся на полный доступ, то наверняка он системный
        IsSystemProcess = True
    End If
End Function
 
Private Sub Form_Load()
    Me.AutoRedraw = True
    Print Chr(34) & IsSystemProcess(GetCurrentProcessId) & Chr(34)
End Sub