[WinAPI] QueryServiceObjectSecurity

Calling QueryServiceObjectSecurity (http://msdn.microsoft.com/en-us/library/aa379312%28VS.85%29.aspx) with a SCManager handle works correctly on Vista, but it throws an ERROR_INVALID_HANDLE on XP. Am I doing something wrong (inb4 "writing Windows software"), or is it the correct behaviour for XP? There are no remarks on the msdn page for the function, but elsewhere it says:
Windows Server 2003 and Windows XP/2000: Unlike most other securable objects, the security descriptor for the SCM cannot be modified.
But if I can't get the security descriptor for the SCManager, how else am I supposed to do an AccessCheck?

QueryServ
Stopped reading right there:  identifier too long.