Steve,

Try this. I ran it on a W2K AS SP3 machine from VFP7 SP1 and it fired off Notepad.exe for me.

#DEFINE LOGON_WITH_PROFILE         0x1
#DEFINE LOGON_NETCREDENTIALS_ONLY    0x2
#DEFINE CREATE_DEFAULT_ERROR_MODE   0x4000000
#DEFINE CREATE_NEW_CONSOLE         0x10
#DEFINE CREATE_NEW_PROCESS_GROUP   0x200
#DEFINE CREATE_SEPARATE_WOW_VDM   0x800
#DEFINE CREATE_SUSPENDED            0x4
#DEFINE CREATE_UNICODE_ENVIRONMENT   0x400
#DEFINE ABOVE_NORMAL_PRIORITY_CLASS   0x8000
#DEFINE BELOW_NORMAL_PRIORITY_CLASS   0x4000
#DEFINE HIGH_PRIORITY_CLASS         0x80
#DEFINE IDLE_PRIORITY_CLASS            0x40
#DEFINE NORMAL_PRIORITY_CLASS         0x20
#DEFINE REALTIME_PRIORITY_CLASS      0x100
#DEFINE CR                        CHR(13) && Carriage Return
#DEFINE ERROR_SUCCESS           0        && Success error code from WINERROR.H
#DEFINE FORMAT_MESSAGE_FROM_SYSTEM     0x00001000 && Value for use with FormatMessage

LOCAL lpStartupInfo AS STRING , ;
	lpProcessInfo AS STRING, ;
	lpBuffer as String, ;
	lnError as Integer, ;
	ONET AS WScript.NETWORK

ONET = NEWOBJECT("WScript.Network")
cHost = ONET.ComputerName
RELEASE ONET

*!* Declare function to return system error code if an API call fails.
DECLARE INTEGER GetLastError IN win32api

*!* Declare function to return text message from system error code.
DECLARE INTEGER FormatMessage IN kernel32.DLL ;
	INTEGER dwFlags, ;
	STRING @lpSource, ;
	INTEGER dwMessageId, ;
	INTEGER dwLanguageId, ;
	STRING @lpBuffer, ;
	INTEGER nSize, ;
	INTEGER Arguments

DECLARE LONG CreateProcessWithLogonW IN advapi32.DLL ;
	STRING lpUsername , ;
	STRING lpDomain , ;
	STRING lpPassword , ;
	LONG dwLogonFlags , ;
	STRING lpApplicationName , ;
	STRING lpCommandLine , ;
	LONG dwCreationFlags , ;
	LONG lpEnvironment , ;
	STRING lpCurrentDirectory , ;
	STRING @lpStartupInfo , ;
	STRING @lpProcessInfo

cUser = STRCONV("aaa"+ CHR(0),12)
cDomain = STRCONV(cHost + CHR(0),12)
cPass = STRCONV("aaa"+ CHR(0),12)
cAppName = STRCONV("c:\winnt\system32\NOTEPAD.EXE" + CHR(0),12)
cCommandLine = "" + CHR(0)
cDir = STRCONV("C:\"+ CHR(0),12)
pStart = long2str(68) + REPLICATE(CHR(0), 64)
pProc = REPLICATE(CHR(0), 16)


? CreateProcessWithLogonW( ;
	cUser , ;
	cDomain , ;
	cPass , ;
	LOGON_WITH_PROFILE , ;
	cAppName , ;
	cCommandLine , ;
	CREATE_NEW_PROCESS_GROUP , ;
	0 , ;
	cDir , ;
	@pStart , ;
	@pProc ;
	)

lpBuffer  = SPACE(128)
lnError = GetLastError()
=FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM, ;
	'WINERROR.H', lnError, 0, @lpBuffer, 128 , 0)

IF lnError <> 0
	=MESSAGEBOX("System error has occurred." + CR + ;
		"System Error code: " + ALLTRIM(STR(lnError)) + CR + ;
		"System Error message: "+ALLT(lpBuffer),0,"ERROR")
ENDIF
CLEAR DLLS



************************************
FUNCTION long2str
	********************
	* Passed : 32-bit non-negative numeric value (m.longval)
	* Returns : ASCII character representation of passed
	* value in low-high format (m.retstr)
	* Example :
	* m.long = 999999
	* m.longstr = long2str(m.long)
	PARAMETERS m.longval
	PRIVATE i, m.retstr
	m.retstr = ""
	FOR i = 24 TO 0 STEP -8
		m.retstr = CHR(INT(m.longval/(2^i))) + m.retstr
		m.longval = MOD(m.longval, (2^i))
	NEXT
	RETURN m.retstr
ENDFUNC