I think I know what is going on - I was not asking for the SE_SECURITY_NAME which is needed for ACCESS_SYSTEM_SECURITY
on 7 and 8 (not 8.1?) I'm guessing this wasnt required (note that this MSDN page is clear that it's needed) - http://msdn.microsoft.com/en-us/library/windows/desktop/aa374892(v=vs.85).aspx
anyway, problem solved - thanks for your help Eric