COM client , server

I am implementing a COM Server
In this server was implementing IUnknown and IClassFactory
interfaces.
I register server object in the Running Object Table with a moniker and pointer to the IClassFactory interface:

LPMONIKER            lpMon;
DWORD                dwReg;
WCHAR            lpszDelim[MAX_PATH];
WCHAR            lpszItem[MAX_PATH];

       MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, "!", -1,
                                                     lpszDelim, MAX_PATH);
       MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED,                                                     "Name1", -1,lpszItem, MAX_PATH);

     CreateItemMoniker(lpszDelim, lpszItem, &lpMon);
     GetRunningObjectTable(0, &lpRot);
     if(lpRot->IsRunning(lpMon) == S_OK)
         {
             MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED,                                                            "Name2", -1,lpszItem, MAX_PATH);
            CreateItemMoniker(lpszDelim, lpszItem, &lpMon);
         }
    lpRot->Register(0, (IUnknown *)&classfactory,lpMon, &dwReg);
  .....                                          lpMon, &dwReg);
  .....

In the client application I want to get a server object via it moniker
from Running Object Table:

LPMONIKER            lpMon;
DWORD                dwReg;
WCHAR            lpszDelim[MAX_PATH];
WCHAR            lpszItem[MAX_PATH];

       MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED, "!", -1,
                                                     lpszDelim, MAX_PATH);
       MultiByteToWideChar(CP_ACP, MB_PRECOMPOSED,                                                     "Name1", -1,lpszItem, MAX_PATH);

     GetRunningObjectTable(0, &lpRot);
     if(lpRot->IsRunning(lpMon) == S_OK)
       {
          lpRot->GetObject(lpMon, &punk);
          pcf = (LPCLASSFACTORY)punk;
          hr = pcf->CreateInstance(NULL, IID_IUnknown,                                                             (LPVOID*)&punk);
        }

In spite of that pointer to object is not NULL I got Access Violation
when I try to use this pointer. So I don't get a right pointer.
What is a mistake ?
What can I do for geting pointer to one definity COM server object when same COM server (whith same CLSID) is running more than
once?