NT createX calls made with ntlmssp have "impersonation level" set to 0x2. NT createX calls _without_ ntlmssp have "imp level" set to 0x1. i guess it's time to implement cli_nt_create_x.