diff --git a/reactos/lib/rosrtl/thread/priv.c b/reactos/lib/rosrtl/thread/priv.c
index e7306cac02d..0f4db72af7e 100644
--- a/reactos/lib/rosrtl/thread/priv.c
+++ b/reactos/lib/rosrtl/thread/priv.c
@@ -73,13 +73,18 @@ RosEnableThreadPrivileges(HANDLE *hPreviousToken,
     LocalFree((HLOCAL)privs);
     
     /* Perform the impersonation */
-    Ret = SetThreadToken(NULL, hToken);
+    Ret = SetThreadToken(NULL, hNewToken);
     
     if(Ret)
     {
       /* only copy the previous token handle on success */
       *hPreviousToken = hToken;
     }
+    else
+    {
+      /* We don't return the previous token handle on failure, so close it here */
+      CloseHandle(hToken);
+    }
     
     /* We don't need the handle to the new token anymore */
     CloseHandle(hNewToken);