If the current integrity level is local_system It will call WTSQueryUserToken and CreateProcessAsUser to start a new process with system privilege as shown in Figure 20. It will call WTSQueryUserToken and CreateProcessAsUser to start a new process with system privilege as shown in Figure 20