Question about Launching shell command from Credential Provider

We need to launch our applicatoin from the
IConnectableCredentialProviderCredential::Connect().

I have following questions:

1. In the FAQ of Microsoft's "Sample Credential Providers Overview",
Microsoft says, "USER applications may not run on the Winlogon
Desktop". But I launched our application successfully. Can somebody
explain what do they mean what by "user applicatoin"?

2. Continuing with the scenarios above, our application will need to
impersonate itself as a specific user and access registry/filesof that
user. Is this feasible? Does the impersonation operation turn our
application into a "User application"?

3. When a Credential Provider is destroyed after user logged on, will
the processes it launched be destroyed as well?

Thanks!
kfg