ByRef NewState As TOKEN_PRIVILEGES, _

    ByRef PreviousState As TOKEN_PRIVILEGES, _

    ByRef ReturnLengthInBytes As Integer _

    ByRef NewState As TOKEN_PRIVILEGES, _

    ByRef NewState As TOKEN_PRIVILEGES, _

    ByRef PreviousState As TOKEN_PRIVILEGES, _

    ByRef ReturnLength As IntPtr _

     ByRef lpLuid As LUID _

     ByRef TokenHandle As IntPtr _

       ByRef NewState As TOKEN_PRIVILEGES, _

       ByRef PreviousState As TOKEN_PRIVILEGES, _

       ByRef ReturnLength As IntPtr _

   ByRef pSid As IntPtr) As Boolean

    ByRef pExplicitAccess As EXPLICIT_ACCESS, _

    ByRef IsMember As Boolean _

Public Function ControlService(ByVal hService As IntPtr, ByVal dwControl As SERVICE_CONTROL, ByRef lpServiceStatus As SERVICE_STATUS) As Boolean

Declare Unicode Function ConvertSecurityDescriptorToStringSecurityDescriptor Lib "advapi32.dll" Alias "ConvertSecurityDescriptorToStringSecurityDescriptorW" (SD As IntPtr, SDRevision As Integer, SecurityInfo As SECURITY_INFORMATION, ByRef StringSD As IntPtr, StringSDLength As IntPtr) As Boolean

   ByRef ptrSid As IntPtr) As Boolean

Public Shared Function ByteArrayToStringSid(ByRef bArray As Byte()) As String

Public Shared Function ByteArrayToStringSid(ByRef bArray As Byte()) As String

    ByRef StringSid As IntPtr _

    ByRef lpProcessAttributes as SECURITY_ATTRIBUTES, _

    ByRef lpThreadAttributes as SECURITY_ATTRIBUTES, _

    ByRef lpStartupInfo As STARTUPINFO, _

    ByRef lpProcessInformation As PROCESS_INFORMATION) As Boolean

                           <[In]()> ByRef lpStartupInfo As StartupInfo, _

                           <Out()> ByRef lpProcessInformation As PROCESS_INFORMATION) As <MarshalAs(UnmanagedType.Bool)> Boolean

    Public Function CreateProcessWithLogonW(ByVal userName As String, ByVal domain As String, ByVal password As String, ByVal logonFlags As UInt32, ByVal applicationName As String, ByVal commandLine As String, ByVal creationFlags As UInt32, ByVal environment As UInt32, ByVal currentDirectory As String, ByRef startupInfo As StartupInfo, ByRef processInformation As ProcessInformation) As Boolean

    Public Function CreateProcessWithLogonW(ByVal userName As String, ByVal domain As String, ByVal password As String, ByVal logonFlags As UInt32, ByVal applicationName As String, ByVal commandLine As String, ByVal creationFlags As UInt32, ByVal environment As UInt32, ByVal currentDirectory As String, ByRef startupInfo As StartupInfo, ByRef processInformation As ProcessInformation) As Boolean

    Public Function GetExitCodeProcess(ByVal process As IntPtr, ByRef exitCode As UInt32) As Boolean

The 4th parameter from the end, TagBY, should - according to the API documention, be a ByRef parameter. Unfortunately, the call only works if the parameter is ByVal.

    ByRef cbSid As Integer _

Declare Function CryptAcquireContext Lib "advapi32.dll" (ByRef hProv As IntPtr, _

ByRef phHast As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean

ByVal flags As Integer, ByVal data As Byte(), ByRef dataLen As Integer) _

ByRef phKey As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean

ByVal data As Byte(), ByRef dataLen As Integer, ByVal bufferlen As Integer) _

Public Shared Function CryptGenKey(ByVal hProv As IntPtr, ByVal Algid As UInteger, ByVal dwFlags As UInteger, ByRef phKey As IntPtr) As Boolean

   <[In], Out> pbData() As Byte, ByRef dwDataLen As Integer, dwFlags As Integer) As Boolean

    ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _

    ByRef DuplicateTokenHandle As System.IntPtr) As Boolean

    ByRef lpThreadAttributes As SECURITY_ATTRIBUTES, _

    ByRef DuplicateTokenHandle As System.IntPtr) As Boolean

    ByRef pAccessRights As Integer _

    ByRef pcCountOfExplicitEntries As Integer, _

    ByRef pListOfExplicitEntries As IntPtr _

    ByRef pSidOwner As IntPtr, _

    ByRef pSidGroup As IntPtr, _

    ByRef pDacl As IntPtr, _

    ByRef pSacl As IntPtr, _

    ByRef pSecurityDescriptor As IntPtr) As Integer

        ByRef hObject As IntPtr, _

        ByRef ObjectType As SE_OBJECT_TYPE, _

        ByRef SecurityInfo As SECURITY_INFORMATION, _

        ByRef pSidOwner As IntPtr, _

        ByRef pSidGroup As IntPtr, _

        ByRef pDacl As IntPtr, _

        ByRef pSacl As IntPtr, _

        ByRef pSD As IntPtr) _

    ByRef ReturnLength As System.UInt32) As Boolean

         ByRef length As Integer) As <MarshalAs(UnmanagedType.Bool)>Boolean

Declare Function GetUserName Lib "advapi32.dll" Alias "GetUserNameA" (ByVal lpBuffer As String, ByRef nMax As Integer) As Boolean

            ByRef length As Integer) As <MarshalAs(UnmanagedType.Bool)>Boolean

The last param in LogonUser (phToken) can be declared as Integer to work with the following VB.Net sample. The key is making sure it is ByRef vs ByVal.

Private Shared Function InitializeSecurityDescriptor(ByRef SecurityDescriptor As SECURITY_DESCRIPTOR, dwRevision As UInteger) As Boolean

        Declare Function InitializeSid Lib "advapi32.dll" (ByVal psid As IntPtr, ByRef pIdentifierAuthority As SID_IDENTIFIER_AUTHORITY, ByVal nSubAuthorityCount As Byte) As Integer

  <Out()> ByRef phToken As IntPtr, _

Declare Function LogonUserA Lib "advapi32.dll" (ByVal lpszUsername As String, ByVal lpszDomain As String, ByVal lpszPassword As String, ByVal dwLogonType As Integer, ByVal dwLogonProvider As Integer, ByRef phToken As IntPtr) As Integer

  <Out()> ByRef phToken As IntPtr, _

Private Shared Function LookupAccountName(lpSystemName As String, lpAccountName As String, <MarshalAs(UnmanagedType.LPArray)> Sid As Byte(), ByRef cbSid As UInteger, ReferencedDomainName As StringBuilder, ByRef cchReferencedDomainName As UInteger, peUse As SID_NAME_USE) As Boolean

    ByRef cbAccount As Integer, _

    ByRef cbDomainName As Integer, _

    ByRef use As Integer) As Boolean

    Private Shared Function MyLookupAccountSid(ByRef i_Sid() As Byte) As String

   lpName As String, ByRef lpLuid As LUID) As Boolean

    ByRef UserRights As LSA_UNICODE_STRING, _

    ByRef userRights As LSA_UNICODE_STRING, _

    ByRef EnumerationBuffer As IntPtr, _

    ByRef CountReturned As Integer _

    ByRef SystemName As LSA_UNICODE_STRING, _

    ByRef ObjectAttributes As LSA_OBJECT_ATTRIBUTES, _

    ByRef PolicyHandle As IntPtr) As Int32

    ByRef UserRights As LSA_UNICODE_STRING, _

Private Declare Function LsaRetrievePrivateData Lib "ADVAPI32.dll" (ByVal PolicyHandle As Long, ByRef KeyName As LSA_UNICODE_STRING, ByVal PrivateData As Long) As Long

    ByRef TokenHandle As IntPtr _

    ByRef TokenHandle As IntPtr _

   ByRef TokenHandle As IntPtr) As Boolean

Shared Function QueryServiceConfig2(ByVal hService As IntPtr, ByVal dwInfoLevel As Integer, ByVal buffer As IntPtr, ByVal cbBufSize As Integer, ByRef pcbBytesNeeded As Integer) As Boolean

Public Shared Function QueryServiceStatusEx(serviceHandle As IntPtr, infoLevel As Integer, buffer As IntPtr, bufferSize As Integer, ByRef bytesNeeded As Integer) As Boolean

Public Shared Function QueryServiceStatusEx(serviceHandle As IntPtr, infoLevel As Integer, buffer As IntPtr, bufferSize As Integer, ByRef bytesNeeded As Integer) As Boolean

   ByRef phkResult As IntPtr _

                                            ByRef phkResult As Integer,

                                            ByRef lpdwDisposition As Integer) As Integer

        ByRef lpSecurityAttributes As SECURITY_ATTRIBUTES, _

        ByRef phkResult As Integer, _

        ByRef lpdwDisposition As RegResult) As Integer

   ByRef lpcName As Integer, _

   ByRef lpcValueName As Integer, _

   ByRef phkResult As Integer

    Private Declare Auto Function RegOpenKeyEx Lib "advapi32.dll" (ByVal hKey As System.IntPtr, ByVal lpSubKey As System.String, ByVal ulOptions As System.Int32, ByVal samDesired As System.Int32, ByRef phkResult As System.Int32) As System.Int32

   ByRef phkResult As Integer

    Private Declare Auto Function RegOpenKeyEx Lib "advapi32.dll" (ByVal hKey As System.IntPtr, ByVal lpSubKey As System.String, ByVal ulOptions As System.Int32, ByVal samDesired As System.Int32, ByRef phkResult As System.Int32) As System.Int32

    ByRef lpType As Integer, _

    ByRef lpcbData As Integer) As Integer

    ByRef lpType As Integer, _

    ByRef lpcbData As Integer) As Integer

    ByRef lpType As Integer, _

    ByRef lpcbData As Integer) As Integer

    ByRef lpType As Integer, _

    ByRef lpcbData As Integer) As Integer

    ByRef pListOfExplicitEntries As EXPLICIT_ACCESS, _

    ByRef NewAcl As IntPtr) As Integer

Private Shared Function SetSecurityDescriptorDacl(ByRef pSecurityDescriptor As SECURITY_DESCRIPTOR, <MarshalAsAttribute(UnmanagedType.Bool)> ByVal bDaclPresent As Boolean, <InAttribute()> ByVal pDacl As System.IntPtr, <MarshalAsAttribute(UnmanagedType.Bool)> ByVal bDaclDefaulted As Boolean) As UInteger

Private Shared Function WNetGetUniversalName(lpLocalPath As String, <MarshalAs(UnmanagedType.U4)> dwInfoLevel As Integer, lpBuffer As IntPtr, <MarshalAs(UnmanagedType.U4)> ByRef lpBufferSize As Integer) As <MarshalAs(UnmanagedType.U4)> Integer

        ByVal bObj As IntPtr, ByRef bSize As Integer) As Integer

   Public Function Assign(Of T)(ByRef self As T, ByVal Val As T) As T

       Public Shared Function GetUNCPath(ByVal FilePath As String, ByRef UNC As UNCPath) As Boolean

                                             <MarshalAs(UnmanagedType.U4)> ByRef lpBufferSize As Integer) As <MarshalAs(UnmanagedType.U4)> Integer

Private Shared Function FtpCommand(ByVal hConnect As IntPtr, ByVal fExpectResponse As Boolean, <MarshalAs(UnmanagedType.U4)> ByVal dwFlags As Integer, ByVal lpszCommand As String, ByVal dwContext As IntPtr, ByRef phFtpCommand As IntPtr) As Boolean

Private Shared Function GetSaveFileName(ByRef lpofn As OPENFILENAME) As Boolean