Please bear with me...

I understand the mechanism.

The fact that @FullName is blank - I'm okay with that.

The fact that @Priv returns a *bad* value - that seems wrong to me.

The macros could (attempt) contact the domain, to get the values. I think we see that it is not. It is relying on the existing token.

Also, the environment shows that the %LogonServer% is the last BDC that authenticated the user in interactive mode.
_________________________
{Insert your favorite Witty Tag Line here}