Here's an issue for LAP writers, and the associated workaround.
When a 3rd-party LAP is installed on WM5.0, WM5.0 AKU 0.x, WM5.0 AKU1, or WM5.0 AKU1.x, the system will continually force the SIP down when the device is locked. Users will not be able to easily authenticate with LAPs that require the SIP (e.g., password LAPs).
Set the REG_BINARY registry value: "HKEY_CURRENT_USER\ControlPanel\Owner [PowrPass]" to a single byte with the value 3. If this is not set or set to any value other than 3, the system will force the SIP down continually.