LookupAccountName() fails with "Access Denied" in some very specific cases only

[Stephane Barizien]

On SOME of our domain hosts ONLY, when a process running on machine under
the system account (during a boot-time GPO) asks the DC for the SID for the
computer's account (i.e., DOMAIN\HOSTNAME$) using the LookupAccountName()
API, this fails with error 5, i.e. "Access Denied"...

(FWIW this LookupAccountName() call actually occurs within the invocation of
SETACL.EXE)

Any clue?

If the answer is to switch to LsaLookupNames2(), where can I find sample C++
code to use that API (I'm especially worried about the "Policy Handle"
stuff...)