Hans Leidekker (@hans) commented about dlls/ntdll/unix/security.c:
WINE_DEFAULT_DEBUG_CHANNEL(ntdll);
+/***********************************************************************
NtCreateToken (NTDLL.@)
- */
+NTSTATUS WINAPI NtCreateToken( HANDLE *handle, ACCESS_MASK access, OBJECT_ATTRIBUTES *attr,
TOKEN_TYPE type, LUID *token_id, LARGE_INTEGER *expire, TOKEN_USER *user,
TOKEN_GROUPS *groups, TOKEN_PRIVILEGES *privs, TOKEN_OWNER *owner,
TOKEN_PRIMARY_GROUP *group, TOKEN_DEFAULT_DACL *dacl, TOKEN_SOURCE *source)
You're not using token_id.