CoCreateInstanceEx returns S_OK with invalid credentials on Win2003

I am writing a client application that connects remotely to the server. I need to impersonate the user my client will work with.

This is an excerpt from my code:

COAUTHIDENTITY coAuthIdentity, *pCoAuthIdentity;
COAUTHINFO coAuthInfo;

CComBSTR bstrDomain(domain), bstrServer(server);
CComBSTR bstrUser(user), bstrPassword(password);
CComBSTR bstrServerPrincName(domain);
bstrServerPrincName.Append(L"\\");
bstrServerPrincName.Append(server);

coAuthIdentity.Flags    = SEC_WINNT_AUTH_IDENTITY_UNICODE;
coAuthIdentity.Domain   = (USHORT *)bstrDomain.m_str;
coAuthIdentity.DomainLength = bstrDomain.Length();
coAuthIdentity.Password = (USHORT *)bstrPassword.m_str;
coAuthIdentity.PasswordLength   = bstrPassword.Length();
coAuthIdentity.User     = (USHORT *)bstrUser.m_str;
coAuthIdentity.UserLength   = bstrUser.Length();
pCoAuthIdentity         = &coAuthIdentity;
*ppCoAuthIdentity       = pCoAuthIdentity;

coAuthInfo.dwAuthnSvc       = RPC_C_AUTHN_DEFAULT;  // Have COM negotiate the best authentication service
coAuthInfo.dwAuthzSvc       = RPC_C_AUTHZ_NONE;
coAuthInfo.pwszServerPrincName  = bstrServerPrincName;

coAuthInfo.dwAuthnLevel     = RPC_C_AUTHN_LEVEL_DEFAULT;
coAuthInfo.dwImpersonationLevel = RPC_C_IMP_LEVEL_IMPERSONATE;
coAuthInfo.pAuthIdentityData    = &coAuthIdentity;
coAuthInfo.dwCapabilities       = EOAC_NONE;

COSERVERINFO coServerInfo;
::memset(&coServerInfo, 0, sizeof(COSERVERINFO));

coServerInfo.pwszName    = bstrServer;
coServerInfo.dwReserved1 = 0;
coServerInfo.pAuthInfo   = &coAuthInfo;
coServerInfo.dwReserved2 = 0;

MULTI_QI multiQI = { &__uuidof(IServer), 0, 0 };

TCHAR name [MAX_COMPUTERNAME_LENGTH + 1];
DWORD size = sizeof(name);
DWORD dwServer = CLSCTX_SERVER;
if (::GetComputerName(name, &size) != 0)
{
    if (_wcsicmp(name, coServerInfo.pwszName))
            dwServer = CLSCTX_REMOTE_SERVER;
    else
        dwServer = CLSCTX_LOCAL_SERVER;
}
else
{
    DWORD dwError = GetLastError();
    return HRESULT_FROM_WIN32(dwError);
}    

hr = CoCreateInstanceEx(
    __uuidof(IServer),
        NULL,
    dwServer,
    &coServerInfo,
    1,
    &multiQI);

My problem arises when I have my client and my server installed on the same computer. In Windows 2003, when I pass the credentials of any user (valid or invalid) on my server, the CoCreateInstanceEx function always returns S_OK.

The problem is that the user used on the server side is not impersonated, but the user who launched my client process.

Using Windows 2008 is working correctly. Any ideas?

Thanks in advance.