The server process can impersonate the client's security context on its local system. The server cannot impersonate the client on remote systems.