diff --git a/reactos/include/ddk/winddk.h b/reactos/include/ddk/winddk.h
index 2bdedea11e5..93835a55b01 100644
--- a/reactos/include/ddk/winddk.h
+++ b/reactos/include/ddk/winddk.h
@@ -9535,10 +9535,10 @@ DDKAPI
 ObOpenObjectByName(
   IN POBJECT_ATTRIBUTES  ObjectAttributes,
   IN POBJECT_TYPE  ObjectType,
-  IN OUT PVOID  ParseContext  OPTIONAL,
   IN KPROCESSOR_MODE  AccessMode,
-  IN ACCESS_MASK  DesiredAccess,
   IN PACCESS_STATE  PassedAccessState,
+  IN ACCESS_MASK  DesiredAccess,
+  IN OUT PVOID  ParseContext  OPTIONAL,
   OUT PHANDLE  Handle);
 
 NTOSAPI
diff --git a/reactos/ntoskrnl/cm/cm.h b/reactos/ntoskrnl/cm/cm.h
index 56ccd064111..54120aa2d84 100644
--- a/reactos/ntoskrnl/cm/cm.h
+++ b/reactos/ntoskrnl/cm/cm.h
@@ -708,4 +708,15 @@ NTSTATUS
 CmiSaveTempHive (PREGISTRY_HIVE Hive,
 		 HANDLE FileHandle);
 
+NTSTATUS
+NTAPI
+CmFindObject(
+    POBJECT_CREATE_INFORMATION ObjectCreateInfo,
+    PUNICODE_STRING ObjectName,
+    PVOID* ReturnedObject,
+    PUNICODE_STRING RemainingPath,
+    POBJECT_TYPE ObjectType,
+    IN PACCESS_STATE AccessState,
+    IN PVOID ParseContext
+);
 #endif /*__INCLUDE_CM_H*/
diff --git a/reactos/ntoskrnl/cm/ntfunc.c b/reactos/ntoskrnl/cm/ntfunc.c
index f675a945bd2..149e53bf1fe 100644
--- a/reactos/ntoskrnl/cm/ntfunc.c
+++ b/reactos/ntoskrnl/cm/ntfunc.c
@@ -199,7 +199,6 @@ NtCreateKey(OUT PHANDLE KeyHandle,
   KPROCESSOR_MODE PreviousMode;
   UNICODE_STRING CapturedClass = {0};
   HANDLE hKey;
-  OBP_LOOKUP_CONTEXT Context;
 
   PAGED_CODE();
 
@@ -259,12 +258,11 @@ NtCreateKey(OUT PHANDLE KeyHandle,
       goto Cleanup;
     }
     
-  Status = ObFindObject(&ObjectCreateInfo,
+  Status = CmFindObject(&ObjectCreateInfo,
                         &ObjectName,
                         (PVOID*)&Object,
                         &RemainingPath,
                         CmiKeyType,
-                        &Context,
                         NULL,
                         NULL);
   if (!NT_SUCCESS(Status))
@@ -1266,7 +1264,6 @@ NtOpenKey(OUT PHANDLE KeyHandle,
   OBJECT_CREATE_INFORMATION ObjectCreateInfo;
   REG_PRE_OPEN_KEY_INFORMATION PreOpenKeyInfo;
   REG_POST_OPEN_KEY_INFORMATION PostOpenKeyInfo;
-  OBP_LOOKUP_CONTEXT Context;
 
   PAGED_CODE();
 
@@ -1330,12 +1327,11 @@ NtOpenKey(OUT PHANDLE KeyHandle,
 
   RemainingPath.Buffer = NULL;
 
-  Status = ObFindObject(&ObjectCreateInfo,
+  Status = CmFindObject(&ObjectCreateInfo,
                         &ObjectName,
 	                (PVOID*)&Object,
                         &RemainingPath,
                         CmiKeyType,
-                        &Context,
                         NULL,
                         NULL);
   if (!NT_SUCCESS(Status))
diff --git a/reactos/ntoskrnl/cm/registry.c b/reactos/ntoskrnl/cm/registry.c
index f6ab4fd097c..fd85543e274 100644
--- a/reactos/ntoskrnl/cm/registry.c
+++ b/reactos/ntoskrnl/cm/registry.c
@@ -704,7 +704,6 @@ CmiConnectHive(IN POBJECT_ATTRIBUTES KeyObjectAttributes,
   PWSTR SubName;
   UNICODE_STRING ObjectName;
   OBJECT_CREATE_INFORMATION ObjectCreateInfo;
-  OBP_LOOKUP_CONTEXT Context;
 
   DPRINT("CmiConnectHive(%p, %p) called.\n",
 	 KeyObjectAttributes, RegistryHive);
@@ -722,12 +721,11 @@ CmiConnectHive(IN POBJECT_ATTRIBUTES KeyObjectAttributes,
 	return Status;
      }
 
-  Status = ObFindObject(&ObjectCreateInfo,
+  Status = CmFindObject(&ObjectCreateInfo,
                         &ObjectName,
 			            (PVOID*)&ParentKey,
                         &RemainingPath,
                         CmiKeyType,
-                        &Context,
                         NULL,
                         NULL);
      ObpReleaseCapturedAttributes(&ObjectCreateInfo);
@@ -857,8 +855,8 @@ CmiDisconnectHive (IN POBJECT_ATTRIBUTES KeyObjectAttributes,
 
   Status = ObOpenObjectByName (KeyObjectAttributes,
 			       CmiKeyType,
-			       NULL,
 			       KernelMode,
+			       NULL,
 			       STANDARD_RIGHTS_REQUIRED,
 			       NULL,
 			       &KeyHandle);
diff --git a/reactos/ntoskrnl/cm/regobj.c b/reactos/ntoskrnl/cm/regobj.c
index b6ba47cc4fc..bbc2cdc1ac7 100644
--- a/reactos/ntoskrnl/cm/regobj.c
+++ b/reactos/ntoskrnl/cm/regobj.c
@@ -23,7 +23,202 @@ CmiGetLinkTarget(PREGISTRY_HIVE RegistryHive,
 		 PUNICODE_STRING TargetPath);
 
 /* FUNCTONS *****************************************************************/
+NTSTATUS
+NTAPI
+CmFindObject(POBJECT_CREATE_INFORMATION ObjectCreateInfo,
+             PUNICODE_STRING ObjectName,
+             PVOID* ReturnedObject,
+             PUNICODE_STRING RemainingPath,
+             POBJECT_TYPE ObjectType,
+             IN PACCESS_STATE AccessState,
+             IN PVOID ParseContext)
+{
+    PVOID NextObject;
+    PVOID CurrentObject;
+    PVOID RootObject;
+    POBJECT_HEADER CurrentHeader;
+    NTSTATUS Status;
+    PWSTR current;
+    UNICODE_STRING PathString;
+    ULONG Attributes;
+    UNICODE_STRING CurrentUs;
+    OBP_LOOKUP_CONTEXT Context;
 
+    PAGED_CODE();
+
+    DPRINT("CmindObject(ObjectCreateInfo %x, ReturnedObject %x, "
+        "RemainingPath %x)\n",ObjectCreateInfo,ReturnedObject,RemainingPath);
+
+    RtlInitUnicodeString (RemainingPath, NULL);
+
+    if (ObjectCreateInfo->RootDirectory == NULL)
+    {
+        ObReferenceObjectByPointer(NameSpaceRoot,
+            DIRECTORY_TRAVERSE,
+            NULL,
+            ObjectCreateInfo->ProbeMode);
+        CurrentObject = NameSpaceRoot;
+    }
+    else
+    {
+        Status = ObReferenceObjectByHandle(ObjectCreateInfo->RootDirectory,
+            0,
+            NULL,
+            ObjectCreateInfo->ProbeMode,
+            &CurrentObject,
+            NULL);
+        if (!NT_SUCCESS(Status))
+        {
+            return Status;
+        }
+    }
+
+    if (ObjectName->Length == 0 ||
+        ObjectName->Buffer[0] == UNICODE_NULL)
+    {
+        *ReturnedObject = CurrentObject;
+        return STATUS_SUCCESS;
+    }
+
+    if (ObjectCreateInfo->RootDirectory == NULL &&
+        ObjectName->Buffer[0] != L'\\')
+    {
+        ObDereferenceObject (CurrentObject);
+        DPRINT1("failed\n");
+        return STATUS_UNSUCCESSFUL;
+    }
+
+    /* Create a zero-terminated copy of the object name */
+    PathString.Length = ObjectName->Length;
+    PathString.MaximumLength = ObjectName->Length + sizeof(WCHAR);
+    PathString.Buffer = ExAllocatePool (NonPagedPool,
+        PathString.MaximumLength);
+    if (PathString.Buffer == NULL)
+    {
+        ObDereferenceObject (CurrentObject);
+        return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    RtlCopyMemory (PathString.Buffer,
+        ObjectName->Buffer,
+        ObjectName->Length);
+    PathString.Buffer[PathString.Length / sizeof(WCHAR)] = UNICODE_NULL;
+
+    current = PathString.Buffer;
+
+    RootObject = CurrentObject;
+    Attributes = ObjectCreateInfo->Attributes;
+    if (ObjectType == ObSymbolicLinkType)
+        Attributes |= OBJ_OPENLINK;
+
+    while (TRUE)
+    {
+        CurrentHeader = OBJECT_TO_OBJECT_HEADER(CurrentObject);
+
+        /* Loop as long as we're dealing with a directory */
+        while (CurrentHeader->Type == ObDirectoryType)
+        {
+            PWSTR Start, End;
+            PVOID FoundObject;
+            UNICODE_STRING StartUs;
+            NextObject = NULL;
+
+            if (!current) goto Next;
+
+            Start = current;
+            if (*Start == L'\\') Start++;
+
+            End = wcschr(Start, L'\\');
+            if (End != NULL) *End = 0;
+
+            RtlInitUnicodeString(&StartUs, Start);
+            Context.DirectoryLocked = TRUE;
+            Context.Directory = CurrentObject;
+            FoundObject = ObpLookupEntryDirectory(CurrentObject, &StartUs, Attributes, FALSE, &Context);
+            if (FoundObject == NULL)
+            {
+                if (End != NULL)
+                {
+                    *End = L'\\';
+                }
+                 goto Next;
+            }
+
+            ObReferenceObjectByPointer(FoundObject,
+                STANDARD_RIGHTS_REQUIRED,
+                NULL,
+                UserMode);
+            if (End != NULL)
+            {
+                *End = L'\\';
+                current = End;
+            }
+            else
+            {
+                current = NULL;
+            }
+
+            NextObject = FoundObject;
+
+Next:
+            if (NextObject == NULL)
+            {
+                break;
+            }
+            ObDereferenceObject(CurrentObject);
+            CurrentObject = NextObject;
+            CurrentHeader = OBJECT_TO_OBJECT_HEADER(CurrentObject);
+        }
+
+        if (CurrentHeader->Type->TypeInfo.ParseProcedure == NULL)
+        {
+            DPRINT("Current object can't parse\n");
+            break;
+        }
+
+        RtlInitUnicodeString(&CurrentUs, current);
+        Status = CurrentHeader->Type->TypeInfo.ParseProcedure(CurrentObject,
+            CurrentHeader->Type,
+            AccessState,
+            ExGetPreviousMode(), // fixme: should be a parameter, since caller decides.
+            Attributes,
+            &PathString,
+            &CurrentUs,
+            ParseContext,
+            NULL, // fixme: where do we get this from? captured OBP?
+            &NextObject);
+        current = CurrentUs.Buffer;
+        if (Status == STATUS_REPARSE)
+        {
+            /* reparse the object path */
+            NextObject = NameSpaceRoot;
+            current = PathString.Buffer;
+
+            ObReferenceObjectByPointer(NextObject,
+                DIRECTORY_TRAVERSE,
+                NULL,
+                ObjectCreateInfo->ProbeMode);
+        }
+
+
+        if (NextObject == NULL)
+        {
+            break;
+        }
+        ObDereferenceObject(CurrentObject);
+        CurrentObject = NextObject;
+    }
+
+    if (current)
+    {
+        RtlpCreateUnicodeString (RemainingPath, current, NonPagedPool);
+    }
+
+    RtlFreeUnicodeString (&PathString);
+    *ReturnedObject = CurrentObject;
+
+    return STATUS_SUCCESS;
+}
 
 NTSTATUS STDCALL
 CmiObjectParse(IN PVOID ParsedObject,
diff --git a/reactos/ntoskrnl/ex/callback.c b/reactos/ntoskrnl/ex/callback.c
index a2df1a59dfa..caf8743f169 100644
--- a/reactos/ntoskrnl/ex/callback.c
+++ b/reactos/ntoskrnl/ex/callback.c
@@ -205,8 +205,8 @@ ExCreateCallback(
    {
       Status = ObOpenObjectByName(ObjectAttributes,
                                   ExCallbackObjectType,
-                                  NULL,
                                   KernelMode,
+                                  NULL,
                                   0,
                                   NULL,
                                   &Handle);
diff --git a/reactos/ntoskrnl/ex/event.c b/reactos/ntoskrnl/ex/event.c
index 143df16e01c..a233112fbff 100644
--- a/reactos/ntoskrnl/ex/event.c
+++ b/reactos/ntoskrnl/ex/event.c
@@ -212,8 +212,8 @@ NtOpenEvent(OUT PHANDLE EventHandle,
     /* Open the Object */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 ExEventObjectType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hEvent);
diff --git a/reactos/ntoskrnl/ex/evtpair.c b/reactos/ntoskrnl/ex/evtpair.c
index 23786103bfe..7d066bee339 100644
--- a/reactos/ntoskrnl/ex/evtpair.c
+++ b/reactos/ntoskrnl/ex/evtpair.c
@@ -164,8 +164,8 @@ NtOpenEventPair(OUT PHANDLE EventPairHandle,
     /* Open the Object */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 ExEventPairObjectType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hEventPair);
diff --git a/reactos/ntoskrnl/ex/mutant.c b/reactos/ntoskrnl/ex/mutant.c
index a74e7626dec..7e420782044 100644
--- a/reactos/ntoskrnl/ex/mutant.c
+++ b/reactos/ntoskrnl/ex/mutant.c
@@ -194,8 +194,8 @@ NtOpenMutant(OUT PHANDLE MutantHandle,
     /* Open the Object */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 ExMutantObjectType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hMutant);
diff --git a/reactos/ntoskrnl/ex/sem.c b/reactos/ntoskrnl/ex/sem.c
index 11dcc29c488..fc441b9a143 100644
--- a/reactos/ntoskrnl/ex/sem.c
+++ b/reactos/ntoskrnl/ex/sem.c
@@ -188,8 +188,8 @@ NtOpenSemaphore(OUT PHANDLE SemaphoreHandle,
     /* Open the Object */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 ExSemaphoreObjectType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hSemaphore);
diff --git a/reactos/ntoskrnl/ex/timer.c b/reactos/ntoskrnl/ex/timer.c
index d8ba7e03c8b..e3047a38e54 100644
--- a/reactos/ntoskrnl/ex/timer.c
+++ b/reactos/ntoskrnl/ex/timer.c
@@ -508,8 +508,8 @@ NtOpenTimer(OUT PHANDLE TimerHandle,
     /* Open the Timer */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 ExTimerType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hTimer);
diff --git a/reactos/ntoskrnl/io/file.c b/reactos/ntoskrnl/io/file.c
index 9943de5a008..7c384c81a0b 100644
--- a/reactos/ntoskrnl/io/file.c
+++ b/reactos/ntoskrnl/io/file.c
@@ -930,9 +930,9 @@ IoCreateFile(OUT PHANDLE  FileHandle,
 
    /* First try to open an existing named object */
    Status = ObOpenObjectByName(ObjectAttributes,
-                               NULL,
                                NULL,
                                AccessMode,
+                               NULL,
                                DesiredAccess,
                                NULL,
                                &LocalHandle);
diff --git a/reactos/ntoskrnl/io/iocomp.c b/reactos/ntoskrnl/io/iocomp.c
index 946dfb46549..d61a6d9c0a6 100644
--- a/reactos/ntoskrnl/io/iocomp.c
+++ b/reactos/ntoskrnl/io/iocomp.c
@@ -322,8 +322,8 @@ NtOpenIoCompletion(OUT PHANDLE IoCompletionHandle,
     /* Open the Object */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 IoCompletionType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hIoCompletionHandle);
diff --git a/reactos/ntoskrnl/mm/section.c b/reactos/ntoskrnl/mm/section.c
index e9ae6ac2ec4..ba98ca48825 100644
--- a/reactos/ntoskrnl/mm/section.c
+++ b/reactos/ntoskrnl/mm/section.c
@@ -3463,8 +3463,8 @@ NtOpenSection(PHANDLE   SectionHandle,
 
    Status = ObOpenObjectByName(ObjectAttributes,
                                MmSectionObjectType,
-                               NULL,
                                PreviousMode,
+                               NULL,
                                DesiredAccess,
                                NULL,
                                &hSection);
diff --git a/reactos/ntoskrnl/ob/obdir.c b/reactos/ntoskrnl/ob/obdir.c
index e8c5272e254..0612874567f 100644
--- a/reactos/ntoskrnl/ob/obdir.c
+++ b/reactos/ntoskrnl/ob/obdir.c
@@ -334,8 +334,8 @@ NtOpenDirectoryObject (OUT PHANDLE DirectoryHandle,
     /* Open the directory object */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 ObDirectoryType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hDirectory);
diff --git a/reactos/ntoskrnl/ob/obhandle.c b/reactos/ntoskrnl/ob/obhandle.c
index 9b0f5540358..a8d7415e05c 100644
--- a/reactos/ntoskrnl/ob/obhandle.c
+++ b/reactos/ntoskrnl/ob/obhandle.c
@@ -748,10 +748,10 @@ NTSTATUS
 NTAPI
 ObOpenObjectByName(IN POBJECT_ATTRIBUTES ObjectAttributes,
                    IN POBJECT_TYPE ObjectType,
-                   IN OUT PVOID ParseContext,
                    IN KPROCESSOR_MODE AccessMode,
-                   IN ACCESS_MASK DesiredAccess,
                    IN PACCESS_STATE PassedAccessState,
+                   IN ACCESS_MASK DesiredAccess,
+                   IN OUT PVOID ParseContext,
                    OUT PHANDLE Handle)
 {
     UNICODE_STRING RemainingPath;
diff --git a/reactos/ntoskrnl/ob/symlink.c b/reactos/ntoskrnl/ob/symlink.c
index b57b8304091..ec145b42525 100644
--- a/reactos/ntoskrnl/ob/symlink.c
+++ b/reactos/ntoskrnl/ob/symlink.c
@@ -403,8 +403,8 @@ NtOpenSymbolicLinkObject(OUT PHANDLE LinkHandle,
     /* Open the object */
     Status = ObOpenObjectByName(ObjectAttributes,
                                 ObSymbolicLinkType,
-                                NULL,
                                 PreviousMode,
+                                NULL,
                                 DesiredAccess,
                                 NULL,
                                 &hLink);
diff --git a/reactos/ntoskrnl/ps/job.c b/reactos/ntoskrnl/ps/job.c
index 05686336e9e..2b3f9e9a931 100644
--- a/reactos/ntoskrnl/ps/job.c
+++ b/reactos/ntoskrnl/ps/job.c
@@ -413,8 +413,8 @@ NtOpenJobObject (
     {
         Status = ObOpenObjectByName(ObjectAttributes,
             PsJobType,
-            NULL,
             PreviousMode,
+            NULL,
             DesiredAccess,
             NULL,
             &hJob);
diff --git a/reactos/ntoskrnl/ps/process.c b/reactos/ntoskrnl/ps/process.c
index d8b42bd04e3..17abd55b46a 100644
--- a/reactos/ntoskrnl/ps/process.c
+++ b/reactos/ntoskrnl/ps/process.c
@@ -1004,8 +1004,8 @@ NtOpenProcess(OUT PHANDLE ProcessHandle,
         DPRINT("Opening by name\n");
         Status = ObOpenObjectByName(ObjectAttributes,
                                     PsProcessType,
-                                    NULL,
                                     PreviousMode,
+                                    NULL,
                                     DesiredAccess,
                                     NULL,
                                     &hProcess);
diff --git a/reactos/ntoskrnl/ps/thread.c b/reactos/ntoskrnl/ps/thread.c
index edc77b8039d..c96bb95235d 100644
--- a/reactos/ntoskrnl/ps/thread.c
+++ b/reactos/ntoskrnl/ps/thread.c
@@ -720,8 +720,8 @@ NtOpenThread(OUT PHANDLE ThreadHandle,
         /* Open it */
         Status = ObOpenObjectByName(ObjectAttributes,
                                     PsThreadType,
-                                    NULL,
                                     PreviousMode,
+                                    NULL,
                                     DesiredAccess,
                                     NULL,
                                     &hThread);
diff --git a/reactos/subsystems/win32/win32k/ntuser/desktop.c b/reactos/subsystems/win32/win32k/ntuser/desktop.c
index 51e3e08c219..a0dc58bbd9c 100644
--- a/reactos/subsystems/win32/win32k/ntuser/desktop.c
+++ b/reactos/subsystems/win32/win32k/ntuser/desktop.c
@@ -345,8 +345,8 @@ IntParseDesktopPath(PEPROCESS Process,
 
       Status = ObOpenObjectByName(&ObjectAttributes,
                                   ExWindowStationObjectType,
-                                  NULL,
                                   KernelMode,
+                                  NULL,
                                   0,
                                   NULL,
                                   (HANDLE*)hWinSta);
@@ -379,8 +379,8 @@ IntParseDesktopPath(PEPROCESS Process,
 
       Status = ObOpenObjectByName(&ObjectAttributes,
                                   ExDesktopObjectType,
-                                  NULL,
                                   KernelMode,
+                                  NULL,
                                   0,
                                   NULL,
                                   (HANDLE*)hDesktop);
@@ -926,10 +926,10 @@ NtUserCreateDesktop(
    Status = ObOpenObjectByName(
                &ObjectAttributes,
                ExDesktopObjectType,
-               (PVOID)&DummyContext,
                KernelMode,
-               dwDesiredAccess,
                NULL,
+               dwDesiredAccess,
+               (PVOID)&DummyContext,
                (HANDLE*)&Desktop);
    if (!NT_SUCCESS(Status)) RETURN(NULL);
    if (Status == STATUS_OBJECT_NAME_EXISTS)
@@ -1129,8 +1129,8 @@ NtUserOpenDesktop(
    Status = ObOpenObjectByName(
                &ObjectAttributes,
                ExDesktopObjectType,
-               NULL,
                KernelMode,
+               NULL,
                dwDesiredAccess,
                NULL,
                (HANDLE*)&Desktop);
diff --git a/reactos/subsystems/win32/win32k/ntuser/winsta.c b/reactos/subsystems/win32/win32k/ntuser/winsta.c
index d0ca93ec6dc..b2cbe138cd6 100644
--- a/reactos/subsystems/win32/win32k/ntuser/winsta.c
+++ b/reactos/subsystems/win32/win32k/ntuser/winsta.c
@@ -444,8 +444,8 @@ NtUserCreateWindowStation(
    Status = ObOpenObjectByName(
                &ObjectAttributes,
                ExWindowStationObjectType,
-               NULL,
                KernelMode,
+               NULL,
                dwDesiredAccess,
                NULL,
                (PVOID*)&WindowStation);
@@ -603,8 +603,8 @@ NtUserOpenWindowStation(
    Status = ObOpenObjectByName(
                &ObjectAttributes,
                ExWindowStationObjectType,
-               NULL,
                UserMode,
+               NULL,
                dwDesiredAccess,
                NULL,
                (PVOID*)&WindowStation);