The problem ended up being that in gpedit.msc, User Configuration - Administrative Templates - System - Custom User Interface should have been set to "Not Configured" instead of Explorer.exe. That allows the non-LS users to use Explorer, and lets LS work for the LS user