MSDN is pretty quiet on the difference between these two functions, which is why I've left CreateProcessWithToken marked as a semi-stub. Using CreateProcessAsUser at least means that the token will be applied to the new process.
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/6601
Tests show that shell windows are per-desktop, not global. Existing tests also show that new desktops from CreateDesktop do not have a shell window set initially. The Default desktop on WinSta0 does, however.
GetShellWindow ought to return an IShellView's window, but we never actually make one of those for the desktop. However, there is a common pattern (used by e.g. GOG Galaxy) of retrieving an unelevated token by duplicating that of the owner of GetShellWindow, so having any window set at all is a step in the right direction.
--
https://gitlab.winehq.org/wine/wine/-/merge_requests/6600