Thanks, it works now.
Here is the full code fromm a test service:


This is what I wanted to do:
procedure TWorkerThread.SetControlPanelAccess(Access: Boolean);
  const

  begin
    if not xbwImpersonateLoggedOnUser then begin
      { log error }
      exit;
      end;
    if Access then xbwWriteCurrUserRegKey(cExplorerPolicies,'NoControlPanel',0)
              else xbwWriteCurrUserRegKey(cExplorerPolicies,'NoControlPanel',1);
    xbwRevertToSelf;
  end; { SetControlPanelAccess }


With the xbw.... procs in:
(the Write2Log calls are just some log calls for testing }


unit xbwLogin;
{$WARN SYMBOL_PLATFORM OFF}


(* This is a unit picked from
 * http://www.delphifaq.com/faq/delphi_windows_API/f663.shtml
 * We only need xbwImpersonateLoggedOnUser and xbwRevertToSelf.
 * Other procedures read from an INI file which will not be applicable,
 * so before using them, update and test this code (also the defined Consts)
 *)


interface


uses 
  Windows,
  TLHelp32, 
  SysUtils,
  Classes; 


const
  wtsapi     = 'wtsapi32.dll';
  advapi32   = 'advapi32.dll';
  userenvlib = 'userenv.dll';
  TOKEN_ADJUST_SESSIONID = $0100;
  {$EXTERNALSYM TOKEN_ADJUST_SESSIONID}
  SE_DEBUG_NAME = 'SeDebugPrivilege';
  {$EXTERNALSYM SE_DEBUG_NAME}


type
  _TOKEN_INFORMATION_CLASS = (TokenInfoClassPad0, TokenUser, TokenGroups,
  TokenPrivileges, TokenOwner, TokenPrimaryGroup, TokenDefaultDacl, TokenSource,
  TokenType, TokenImpersonationLevel, TokenStatistics, TokenRestrictedSids,
  TokenSessionId, TokenGroupsAndPrivileges, TokenSessionReference,
  TokenSandBoxInert, TokenAuditPolicy, TokenOrigin);


  { kernel32 }
  TWTSGetActiveConsoleSessionId = function : DWORD; stdcall;

  { wtsapi }

  { advapi32 }

function xbwImpersonateLoggedOnUser: Boolean;
procedure xbwRevertToSelf;
procedure xbwWriteCurrUserRegKey(NameOfKey,StringName: PChar; IntValue: DWORD);


implementation


uses IniFiles, SHFolder, Forms,


uviselog;


const
  STR_PRODUCT = 'Vise';
  INI_SESSION = 'Sessie';
  INI_EXEC    = 'Execute';
  INI_RESULT  = 'Result';


var
  LibsLoaded    : integer=0;
  FhUserTokenDup: THandle; { used for user impersonation }

var ModuleHandle: HMODULE;
begin
  if not Assigned(P) then begin
    ModuleHandle := GetModuleHandle(PChar(ModuleName));
    if ModuleHandle = 0 then
      ModuleHandle := LoadLibrary(PChar(ModuleName));
    if ModuleHandle <> 0 then
      P := Pointer(GetProcAddress(ModuleHandle, PChar(ProcName)));
    Result := Assigned(P);
    end
  else
    Result := True;
end; { GetProcedureAddress }


function InitProcLibs: boolean;
begin
  if LibsLoaded>0 then
    Result := True
  else if LibsLoaded<0 then
    Result := False
  else begin
    LibsLoaded := -1;

       LibsLoaded := 1;
    Result := ( LibsLoaded=1);
  end;
end;  { InitProcLibs }


function xbwSessionNumber: Integer;
var dwSessionID: DWord;
begin
  Result := 0;
  if not InitProcLibs then Exit;
  ProcessIdToSessionId(GetCurrentProcessId(), dwSessionID);
  Result := dwSessionID;
end; { xbwSessionNumber }


function xbwActiveConsole: Integer;
begin
  Result := 0;
  if not InitProcLibs then Exit;
  Result := WTSGetActiveConsoleSessionId;
end;


function xbwGetProcessID(strProcess: String; iSessionID: Integer = -1): DWORD;
(* Returns the process ID of process StrProcess in session iSessionID.
 * If iSessionID is omitted, the active console session. *)
var
  dwSessionId,
  winlogonSessId: DWord;
  hsnap         : THandle;
  procEntry     : TProcessEntry32;
  myPID         : Cardinal;
begin
  Result := 0;
  if not InitProcLibs then Exit;
  if iSessionID = -1 then

    dwSessionId := WTSGetActiveConsoleSessionId
  else
    dwSessionId := iSessionID;
  // Check running processes and return ID of process in current session
  hSnap := CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  if (hSnap = INVALID_HANDLE_VALUE) then Exit;
  strProcess := UpperCase(ExtractFileName(strProcess));
  myPID := GetCurrentProcessId;
  procEntry.dwSize := sizeof(TProcessEntry32);
  if (not Process32First(hSnap, procEntry)) then Exit;
  repeat

      winlogonSessId := 0;

  with TIniFile.Create(strCommonAppData + INI_SESSION) do
    try
      WriteString(STR_PRODUCT, INI_EXEC, strParameters);
      { Collect config into INI transfer... }
      if strConfig <> '' then begin
      strConfig := StringReplace(strConfig, #13, '&RC&', [rfReplaceAll]);
      strConfig := StringReplace(strConfig, ',', '&CM&', [rfReplaceAll]);
      TS := TStringList.Create;
      with TS do
        try
          Delimiter := '|';
          DelimitedText := strConfig;
          for iLoop := 0 to Count -1 do
          WriteString(STR_PRODUCT, Names[iLoop], Strings[iLoop]);
        finally
          Free;
        end;
      end;
      { Start process as standard user... }

      Sleep(1000);
      { Check result... }
      strResult := ReadString(STR_PRODUCT, INI_RESULT, '');
      if strResult <> '' then
        raise Exception.Create(strResult);
    finally
      Free;
    end;
end; { xbwExecProcess }

var
  pi             : PROCESS_INFORMATION;
  si             : STARTUPINFO;
  winlogonPid,
  dwSessionId    : DWord;
  hUserToken,
  hUserTokenDup,
  hPToken,
  hProcess       : THANDLE;
  dwCreationFlags: DWORD;
  tp             : TOKEN_PRIVILEGES;
  lpenv          : pointer;
  bError         : Boolean;
  strClone       : String;
begin

  Result := True;
  bError := False;
  if not InitProcLibs then Exit;

  winlogonPid := xbwGetProcessID(strClone, iSessionID);
  try

    dwSessionId := WTSGetActiveConsoleSessionId;
    WTSQueryUserToken(dwSessionId, hUserToken);
    dwCreationFlags := NORMAL_PRIORITY_CLASS or CREATE_NEW_CONSOLE;
    ZeroMemory(@si, sizeof(STARTUPINFO));
    si.cb := sizeof(STARTUPINFO);
    si.lpDesktop := PChar('Winsta0\Default');
    ZeroMemory(@pi, sizeof(pi));
    hProcess := OpenProcess(MAXIMUM_ALLOWED, FALSE, winlogonPid);

      bError := True;

      bError := True;
    tp.PrivilegeCount := 1;
    tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;

    { adjust token privilege }

    { perform all the close handles tasks... }
    try
      CloseHandle(hProcess);
      CloseHandle(hUserToken);
      CloseHandle(hUserTokenDup);
      CloseHandle(hPToken);
    except
      {}
    end;
  except
    bError := True;
  end;
  Result := not bError;
end; { xbwStartProcess }


function GLE: String;
  var LE: Integer;
  begin
    LE := GetlastError;
    Result := '(' + InttoStr(LE) + ') ' + SysErrorMessage(LE);
  end;


function xbwImpersonateLoggedOnUser: Boolean;
var
  winlogonPid,
  dwSessionId: DWord;
  hUserToken,
  hPToken,
  hProcess   : THANDLE;
  tp         : TOKEN_PRIVILEGES;
  bError     : Boolean;
  strClone   : String;
begin

  Result := True;
  bError := False;
  if not InitProcLibs then begin

    Exit;
    end;
  // Get explorer.exe process ID:
  strClone := 'explorer.exe';
  winlogonPid := xbwGetProcessID(strClone);

  try
    // Get user token for winlogon:
    dwSessionId := WTSGetActiveConsoleSessionId;

    if not WTSQueryUserToken(dwSessionId, hUserToken) then
      begin

      bError := True;
      end;

      begin

      bError := True;
      end;

    // Put it in the TOKEN_PRIVILEGES structure tp

      begin

      bError := True;
      end;
    // Set other tp params:
    tp.PrivilegeCount := 1;
    tp.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;

    if not DuplicateTokenEx(hPToken,

      bError := True;
      end;

    if not SetTokenInformation(FhUserTokenDup,

      bError := True;
      end;

      begin

      bError := True;
      end;
    if (GetLastError() = ERROR_NOT_ALL_ASSIGNED) then begin

      bError := True;
      end;
    // Finally, do the impersonation:
    if not ImpersonateLoggedOnUser(FhUserTokenDup) then
      begin

      bError := True;
      end;


    { perform all the close handles tasks... }
    try
      CloseHandle(hProcess);
      CloseHandle(hUserToken);

      CloseHandle(hPToken);
    except
      on E:Exception do

    end;
  except
    on E:Exception do begin

      bError := True;
    end;
  end;
  Result := not bError;
end; { xbwImpersonateLoggedOnUser }


procedure xbwRevertToSelf;
begin
  RevertToSelf;
  CloseHandle(FhUserTokenDup);
end; { xbwRevertToSelf }


procedure xbwWriteCurrUserRegKey(NameOfKey,StringName: PChar; IntValue: DWORD);
(* We must use RegOpenCurrentUser instead of RegOpenKey(Ex) (TRegistry).
 * These functions don't work with impersonation:
 * http://msdn.microsoft.com/en-us/library/ms685145(VS.85).aspx *)
  var
    phkRoot,
    phkKey : HKEY;
    Res    : Integer;
  begin
    Res := RegOpenCurrentUser(KEY_ALL_ACCESS,phkRoot);
    If Res <> ERROR_SUCCESS then begin

      Exit;
      end;
    Res := RegOpenKeyEx(phkRoot,NameOfKey,0,KEY_ALL_ACCESS,phkKey);
    if Res <> ERROR_SUCCESS then begin

      Exit;
      end;
    Res := RegSetValueEx(phkKey,StringName,0,REG_DWORD,@IntValue,SizeOf(DWORD));
    if Res <> ERROR_SUCCESS then begin

      Exit;
      end;
    Res := RegCloseKey(phkKey);
    if Res <> ERROR_SUCCESS then begin

      Exit;
      end;
  end; { xbwWriteCurrUserRegKey }


end.