ConvertToImpersonatedToken converts the token into an impersonated token. For this purpose the token will be converted and the old TokenHandle will be closed. The impersonated token will be the new TokenHandle. It does nothing if the token is already impersonated. The token instance must be opened with TOKEN_DUPLICATE access right. 

Actually you can impersonate a shared token. The impersonated token will be copied into the instance property TokenHandle. The old handle will not be closed if Share is set to true. You must save the old value to close it by yourself. 

Because the old handle is discarded you must call these functions again : GetTokenPrivileges 

ConvertToImpersonatedToken needs the following access rights:

• TOKEN_QUERY
• READ_CONTROL
• TOKEN_DUPLICATE

This function does the same as ImpersonateLoggedOnUser if used in this way:

    var Token : TJwSecurityToken;
begin
  Token := TJwSecurityToken.CreateTokenByProcess(0,
        TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY or TOKEN_IMPERSONATE or TOKEN_DUPLICATE);
  //Token is the process token
  Token.ConvertToImpersonatedToken(SecurityImpersonation, TOKEN_IMPERSONATE or TOKEN_QUERY);
  //Token is now a new duplicate token (it does not have to do anything with the process token)
  Token.SetThreadToken(0);
  ...do stuff here
  Token.Free;
  Token := TJwSecurityToken.CreateTokenByProcess(0,
        TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY or TOKEN_IMPERSONATE or TOKEN_DUPLICATE);

As you see the token is freed and recreated in contrast to using "RevertToSelf". This is by design, because ConvertToImpersonatedToken converts "Token" to a thread token and loses the process token handle. "ReverToSelf" will not help in this case because there is no token to revert to. 

TJwSecurityToken Methods