Maybe you're right (more details would have been better) but I normally try
to keep my posts brief. I think the question was sufficiently clear enough
however that a response such as "try to call RevertToSelf()" was simplistic
at best :)

The interactive logon session (Susan) needs to impersonate Bob via
"ImpersonateLoggedOnUser()" (or any other relevant function) whereby all of
Bob's *local* activity will run under his credentials. However, when making
any outbound (network) calls, authentication must occur under the
credentials of the interactive logon session instead (Susan's). It's easy
enough to get the token of the interactive logon session but not their
password of course. Therefore, since all relevant functions seem to require
a clear-text password (read on), how can I make use of that token? That is,
how can I pass Susan's credentials to Bob so he can use them to access the
network (given that I only have Susan's token but not her password). Note
(FYI) that Bob simply needs to read a shared network directory but doesn't
have appropriate rights to it. Susan does so her credentials are therefore
required to access it. To accomplish this, Bob could normally just invoke
"NetUseAdd()" to connect to that share by passing Susan's credentials
instead of using his own (by filling in a USE_INFO_2 structure with Susan's
credentials and passing it to "NetUseAdd()"). He needs her password for this
however but doesn't have it nor can the interactive user (Susan) get hold of
it apparently. I'm therefore trying to figure out how to pull off the same
thing without the password. It should be doable I would think given that
Susan is already interactively logged on (she typed her password in already)
and simply wants to hand her cached credentials to Bob so he can use them to
access the network (and for no other purpose).