A lot of Developers have asked if it is possible to generate a token that represents the Local Service or Network Service account without stealing a token.  You can programmatically generate a
token using LogonUser()

Here is the code for doing this:

LogonUser(L"LocalService", L"NT AUTHORITY", NULL, LOGON32_LOGON_SERVICE, LOGON32_PROVIDER_DEFAULT, &hToken)

LogonUser(L"NetworkService", L"NT AUTHORITY", NULL, LOGON32_LOGON_SERVICE, LOGON32_PROVIDER_DEFAULT, &hToken)