Nazim from the IIS team has posted a detailed read on the Token Kidnapping in Windows.

http://blogs.iis.net/nazim/archive/2008/10/14/token-kidnapping-in-windows.aspx

It's definitely worth reading if you are responsible for locking down machines.

Steve