diff --git a/reactos/include/csrss/csrss.h b/reactos/include/csrss/csrss.h
index b50bc6df937..e819f2cf5ba 100644
--- a/reactos/include/csrss/csrss.h
+++ b/reactos/include/csrss/csrss.h
@@ -524,7 +524,7 @@ typedef struct
 
 typedef struct
 {
-  WCHAR DesktopName[1];
+  HDESK DesktopHandle;
 } CSRSS_CREATE_DESKTOP_REQUEST, *PCSRSS_CREATE_DESKTOP_REQUEST;
 
 typedef struct
diff --git a/reactos/include/ddk/mmtypes.h b/reactos/include/ddk/mmtypes.h
index 4508ad169b1..515fee0e4cf 100644
--- a/reactos/include/ddk/mmtypes.h
+++ b/reactos/include/ddk/mmtypes.h
@@ -1,4 +1,4 @@
-/* $Id: mmtypes.h,v 1.19 2004/07/17 03:04:45 ion Exp $ */
+/* $Id: mmtypes.h,v 1.20 2004/11/20 16:46:04 weiden Exp $ */
 
 #ifndef _INCLUDE_DDK_MMTYPES_H
 #define _INCLUDE_DDK_MMTYPES_H
@@ -106,4 +106,36 @@ typedef enum _MEMORY_CACHING_TYPE
 	MmMaximumCacheType
 } MEMORY_CACHING_TYPE;
 
+typedef struct _MMWSL *PMMWSL;
+
+typedef struct _MMSUPPORT_FLAGS {
+    ULONG SessionSpace              : 1;
+    ULONG BeingTrimmed              : 1;
+    ULONG SessionLeader             : 1;
+    ULONG TrimHard                  : 1;
+    ULONG WorkingSetHard            : 1;
+    ULONG AddressSpaceBeingDeleted  : 1;
+    ULONG Available                 : 10;
+    ULONG AllowWorkingSetAdjustment : 8;
+    ULONG MemoryPriority            : 8;
+} MMSUPPORT_FLAGS, *PMMSUPPORT_FLAGS;
+
+typedef struct _MMSUPPORT
+{
+    LARGE_INTEGER   LastTrimTime;
+    MMSUPPORT_FLAGS Flags;
+    ULONG           PageFaultCount;
+    ULONG           PeakWorkingSetSize;
+    ULONG           WorkingSetSize;
+    ULONG           MinimumWorkingSetSize;
+    ULONG           MaximumWorkingSetSize;
+    PMMWSL          VmWorkingSetList;
+    LIST_ENTRY      WorkingSetExpansionLinks;
+    ULONG           Claim;
+    ULONG           NextEstimationSlot;
+    ULONG           NextAgingSlot;
+    ULONG           EstimatedAvailable;
+    ULONG           GrowthSinceLastEstimate;
+} MMSUPPORT, *PMMSUPPORT;
+
 #endif
diff --git a/reactos/include/napi/win32.h b/reactos/include/napi/win32.h
index e3c6e53e021..729220f1477 100644
--- a/reactos/include/napi/win32.h
+++ b/reactos/include/napi/win32.h
@@ -31,8 +31,6 @@ typedef struct _W32PROCESS
   FAST_MUTEX CursorIconListLock;
   LIST_ENTRY CursorIconListHead;
   struct _KBDTABLES* KeyboardLayout;
-  struct _WINSTATION_OBJECT* WindowStation;
-  HANDLE hWindowStation;
   ULONG Flags;
   WORD GDIObjects;
   WORD UserObjects;
diff --git a/reactos/include/ntos/zwtypes.h b/reactos/include/ntos/zwtypes.h
index 1e92f6547bf..b7b33197db4 100755
--- a/reactos/include/ntos/zwtypes.h
+++ b/reactos/include/ntos/zwtypes.h
@@ -1231,8 +1231,7 @@ extern IMPORTED ULONG NtBuildNumber;
 #define ProcessWow64Information			26
 /* ReactOS private. */
 #define ProcessImageFileName			27
-#define ProcessDesktop                          28
-#define MaxProcessInfoClass			29
+#define MaxProcessInfoClass			28
 
 /*
  * thread query / set information class
diff --git a/reactos/ntoskrnl/ex/win32k.c b/reactos/ntoskrnl/ex/win32k.c
index 60472c8a726..cf552ceff4a 100644
--- a/reactos/ntoskrnl/ex/win32k.c
+++ b/reactos/ntoskrnl/ex/win32k.c
@@ -35,16 +35,23 @@ POBJECT_TYPE EXPORTED ExWindowStationObjectType = NULL;
 POBJECT_TYPE EXPORTED ExDesktopObjectType = NULL;
 
 static GENERIC_MAPPING ExpWindowStationMapping = {
-    FILE_GENERIC_READ,
-	  FILE_GENERIC_WRITE,
-	  FILE_GENERIC_EXECUTE,
-	  FILE_ALL_ACCESS };
+  STANDARD_RIGHTS_READ | WINSTA_ENUMDESKTOPS | WINSTA_ENUMERATE |  WINSTA_READATTRIBUTES | WINSTA_READSCREEN,
+  STANDARD_RIGHTS_WRITE | WINSTA_ACCESSCLIPBOARD | WINSTA_CREATEDESKTOP | WINSTA_WRITEATTRIBUTES,
+  STANDARD_RIGHTS_EXECUTE | WINSTA_ACCESSGLOBALATOMS | WINSTA_EXITWINDOWS,
+  STANDARD_RIGHTS_REQUIRED | WINSTA_ACCESSCLIPBOARD | WINSTA_ACCESSGLOBALATOMS | WINSTA_CREATEDESKTOP |
+                             WINSTA_ENUMDESKTOPS | WINSTA_ENUMERATE | WINSTA_EXITWINDOWS |
+                             WINSTA_READATTRIBUTES | WINSTA_READSCREEN | WINSTA_WRITEATTRIBUTES
+};
 
 static GENERIC_MAPPING ExpDesktopMapping = {
-    FILE_GENERIC_READ,
-	  FILE_GENERIC_WRITE,
-	  FILE_GENERIC_EXECUTE,
-	  FILE_ALL_ACCESS };
+  STANDARD_RIGHTS_READ | DESKTOP_ENUMERATE | DESKTOP_READOBJECTS,
+  STANDARD_RIGHTS_WRITE | DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | DESKTOP_HOOKCONTROL |
+                          DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD | DESKTOP_WRITEOBJECTS,
+  STANDARD_RIGHTS_EXECUTE | DESKTOP_SWITCHDESKTOP,
+  STANDARD_RIGHTS_REQUIRED | DESKTOP_CREATEMENU | DESKTOP_CREATEWINDOW | DESKTOP_ENUMERATE |
+                             DESKTOP_HOOKCONTROL | DESKTOP_JOURNALPLAYBACK | DESKTOP_JOURNALRECORD |
+                             DESKTOP_READOBJECTS | DESKTOP_SWITCHDESKTOP | DESKTOP_WRITEOBJECTS
+};
 
 /* FUNCTIONS ****************************************************************/
 
diff --git a/reactos/ntoskrnl/include/internal/mm.h b/reactos/ntoskrnl/include/internal/mm.h
index c6e070b4243..8ed577b6dcc 100644
--- a/reactos/ntoskrnl/include/internal/mm.h
+++ b/reactos/ntoskrnl/include/internal/mm.h
@@ -152,6 +152,19 @@ ULONG           PagefileUsage;
 ULONG           PagefileLimit;
 } EPROCESS_QUOTA_BLOCK, *PEPROCESS_QUOTA_BLOCK;
 
+/*
+ * header mess....
+ */
+
+typedef struct _PAGEFAULT_HISTORY
+{
+    ULONG                                 CurrentIndex;
+    ULONG                                 MaxIndex;
+    KSPIN_LOCK                            SpinLock;
+    PVOID                                 Reserved;
+    struct _PROCESS_WS_WATCH_INFORMATION  WatchInfo[1];
+} PAGEFAULT_HISTORY, *PPAGEFAULT_HISTORY;
+
 #endif /* __USE_W32API */
 
 typedef struct
diff --git a/reactos/ntoskrnl/include/internal/ps.h b/reactos/ntoskrnl/include/internal/ps.h
index 564b95e9fca..b440654e930 100644
--- a/reactos/ntoskrnl/include/internal/ps.h
+++ b/reactos/ntoskrnl/include/internal/ps.h
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: ps.h,v 1.74 2004/11/11 22:23:52 ion Exp $
+/* $Id: ps.h,v 1.75 2004/11/20 16:46:05 weiden Exp $
  *
  * FILE:            ntoskrnl/ke/kthread.c
  * PURPOSE:         Process manager definitions
@@ -283,6 +283,27 @@ typedef struct _KPROCESS
 
 typedef struct _KPROCESS *PKPROCESS;
 
+typedef struct _HARDWARE_PTE_X86 {
+    ULONG Valid             : 1;
+    ULONG Write             : 1;
+    ULONG Owner             : 1;
+    ULONG WriteThrough      : 1;
+    ULONG CacheDisable      : 1;
+    ULONG Accessed          : 1;
+    ULONG Dirty             : 1;
+    ULONG LargePage         : 1;
+    ULONG Global            : 1;
+    ULONG CopyOnWrite       : 1;
+    ULONG Prototype         : 1;
+    ULONG reserved          : 1;
+    ULONG PageFrameNumber   : 20;
+} HARDWARE_PTE_X86, *PHARDWARE_PTE_X86;
+
+typedef struct _WOW64_PROCESS
+{
+  PVOID Wow64;
+} WOW64_PROCESS, *PWOW64_PROCESS;
+
 #endif /* __USE_W32API */
 
 struct _EPROCESS
@@ -306,7 +327,7 @@ struct _EPROCESS
   /* Time of process exit. */
   TIME                  ExitTime;                     /* 088 */
   /* Unknown. */
-  PVOID                 LockOwner;                    /* 090 */
+  PKTHREAD              LockOwner;                    /* 090 */
   /* Process id. */
   ULONG                 UniqueProcessId;              /* 094 */
   /* Unknown. */
@@ -325,30 +346,15 @@ struct _EPROCESS
   ULONG                 PeakVirtualSize;              /* 0BC */
   /* Unknown. */
   LARGE_INTEGER         VirtualSize;                  /* 0C0 */
-  struct
-  {
-    ULONG               LastTrimTime;
-    ULONG               LastTrimFaultCount;
-    ULONG               PageFaultCount;
-    ULONG               PeakWorkingSetSize;
-    ULONG               WorkingSetSize;
-    ULONG               MinimumWorkingSetSize;
-    ULONG               MaximumWorkingSetSize;
-    ULONG               VmWorkingSetList;
-    LIST_ENTRY          WorkingSetExpansionList;
-    UCHAR               AllowWorkingSetAdjustment;
-    UCHAR               AddressSpaceBeingDeleted;
-    UCHAR               ForegroundPrioritySwitch;
-    UCHAR               MemoryPriority;
-  } Vm;
-  PVOID                 LastProtoPteFault;
-  struct _EPORT*        DebugPort;
-  struct _EPORT*        ExceptionPort;
-  PVOID                 ObjectTable;
+
+  MMSUPPORT             Vm;
+  LIST_ENTRY            SessionProcessLinks;
+  struct _EPORT         *DebugPort;
+  struct _EPORT         *ExceptionPort;
+  HANDLE_TABLE          HandleTable;
   PVOID                 Token;
-  /*  FAST_MUTEX            WorkingSetLock; */
-  KMUTEX                WorkingSetLock;
-  PVOID                 WorkingSetPage;
+  FAST_MUTEX            WorkingSetLock;
+  ULONG                 WorkingSetPage;
   UCHAR                 ProcessOutswapEnabled;
   UCHAR                 ProcessOutswapped;
   UCHAR                 AddressSpaceInitialized;
@@ -360,14 +366,15 @@ struct _EPROCESS
   UCHAR                 ForkWasSuccessful;
   UCHAR                 MmAgressiveWsTrimMask;
   PKEVENT               VmOperationEvent;
-  PVOID                 PageDirectoryPte;
+  PVOID                 PaeTop;
   ULONG                 LastFaultCount;
+  ULONG                 ModifiedPageCount;
   PVOID                 VadRoot;
   PVOID                 VadHint;
   PVOID                 CloneRoot;
   ULONG                 NumberOfPrivatePages;
   ULONG                 NumberOfLockedPages;
-  USHORT                NextProcessColour;
+  USHORT                NextPageColor;
   UCHAR                 ExitProcessCalled;
   UCHAR                 CreateProcessReported;
   HANDLE                SectionHandle;
@@ -375,14 +382,20 @@ struct _EPROCESS
   PVOID                 SectionBaseAddress;
   PEPROCESS_QUOTA_BLOCK QuotaBlock;
   NTSTATUS              LastThreadExitStatus;
-  PVOID                 WorkingSetWatch;
+  PPAGEFAULT_HISTORY    WorkingSetWatch;
+  HANDLE                Win32WindowStation;
   HANDLE                InheritedFromUniqueProcessId;
-  ACCESS_MASK           GrantedAccess;
+  ULONG                 GrantedAccess;
   ULONG                 DefaultHardErrorProcessing;
   PVOID                 LdtInformation;
-  ULONG                 VadFreeHint;
+  PVOID                 VadFreeHint;
   PVOID                 VdmObjects;
-  KMUTANT               ProcessMutant;
+  PVOID                 DeviceObjects;
+  ULONG                 SessionId;
+  LIST_ENTRY            PhysicalVadList;
+  HARDWARE_PTE_X86      PageDirectoryPte;
+  ULONGLONG             Filler;
+  ULONG                 PaePageDirectoryPage;
   CHAR                  ImageFileName[16];
   ULONG                 VmTrimFaultValue;
   UCHAR                 SetTimerResolution;
@@ -390,29 +403,31 @@ struct _EPROCESS
   UCHAR                 SubSystemMinorVersion;
   UCHAR                 SubSystemMajorVersion;
   USHORT                SubSystemVersion;
-  struct _W32PROCESS*   Win32Process;
-  HANDLE                Win32WindowStation;
-   
-   /*
-    * Added by David Welch (welch@mcmail.com)
-    */
-  HANDLE                Win32Desktop;
+  struct _W32PROCESS    *Win32Process;
+  struct _EJOB          *Job;
+  ULONG                 JobStatus;
+  LIST_ENTRY            JobLinks;
+  PVOID                 LockedPagesList;
+  struct _EPORT         *SecurityPort;
+  PWOW64_PROCESS        Wow64;
+  LARGE_INTEGER         ReadOperationCount;
+  LARGE_INTEGER         WriteOperationCount;
+  LARGE_INTEGER         OtherOperationCount;
+  LARGE_INTEGER         ReadTransferCount;
+  LARGE_INTEGER         WriteTransferCount;
+  LARGE_INTEGER         OtherTransferCount;
+  ULONG                 CommitChargeLimit;
+  ULONG                 CommitChargePeak;
+  LIST_ENTRY            ThreadListHead;
+  PRTL_BITMAP           VadPhysicalPagesBitMap;
+  ULONG                 VadPhysicalPages;
+  KSPIN_LOCK            AweLock;
+
+  /*
+   * FIXME - ReactOS specified - remove the following fields ASAP!!!
+   */
   MADDRESS_SPACE        AddressSpace;
-  HANDLE_TABLE          HandleTable;
   LIST_ENTRY            ProcessListEntry;
-   
-   /*
-    * Added by Philip Susi for list of threads in process
-    */
-  LIST_ENTRY           ThreadListHead;
-
-  /* Added by Alex Ionescu (alex@relsoft.net)*/
-  ULONG					SessionId;
-  struct _EPORT*		SecurityPort;
-  
-  struct _EJOB*         Job;
-  UINT                  JobStatus;
-
   FAST_MUTEX            TebLock;
   PVOID                 TebBlock;
   PVOID                 TebLastAllocated;
@@ -651,6 +666,8 @@ NTSTATUS PsCreateCidHandle(PVOID Object, POBJECT_TYPE ObjectType, PHANDLE Handle
 NTSTATUS PsDeleteCidHandle(HANDLE CidHandle, POBJECT_TYPE ObjectType);
 PCID_OBJECT PsLockCidHandle(HANDLE CidHandle, POBJECT_TYPE ObjectType);
 VOID PsUnlockCidObject(PCID_OBJECT CidObject);
+NTSTATUS PsLockProcess(PEPROCESS Process, BOOL Timeout);
+VOID PsUnlockProcess(PEPROCESS Process);
 
 #define ETHREAD_TO_KTHREAD(pEThread) (&(pEThread)->Tcb)
 #define KTHREAD_TO_ETHREAD(pKThread) (CONTAINING_RECORD((pKThread), ETHREAD, Tcb))
diff --git a/reactos/ntoskrnl/ps/create.c b/reactos/ntoskrnl/ps/create.c
index 207f265bb77..614f3aa24d8 100644
--- a/reactos/ntoskrnl/ps/create.c
+++ b/reactos/ntoskrnl/ps/create.c
@@ -1,4 +1,4 @@
-/* $Id: create.c,v 1.85 2004/11/10 02:51:00 ion Exp $
+/* $Id: create.c,v 1.86 2004/11/20 16:46:05 weiden Exp $
  *
  * COPYRIGHT:              See COPYING in the top level directory
  * PROJECT:                ReactOS kernel
@@ -386,6 +386,12 @@ PiDeleteThread(PVOID ObjectBody)
   Thread->ThreadsProcess = NULL;
 
   PsDeleteCidHandle(Thread->Cid.UniqueThread, PsThreadType);
+  
+  if(Thread->Tcb.Win32Thread != NULL)
+  {
+    /* Free the W32THREAD structure if present */
+    ExFreePool (Thread->Tcb.Win32Thread);
+  }
 
   KeReleaseThread(ETHREAD_TO_KTHREAD(Thread));
   
diff --git a/reactos/ntoskrnl/ps/kill.c b/reactos/ntoskrnl/ps/kill.c
index 8c6598a3f6d..fbfddd8405f 100644
--- a/reactos/ntoskrnl/ps/kill.c
+++ b/reactos/ntoskrnl/ps/kill.c
@@ -1,4 +1,4 @@
-/* $Id: kill.c,v 1.83 2004/11/13 22:27:15 hbirr Exp $
+/* $Id: kill.c,v 1.84 2004/11/20 16:46:05 weiden Exp $
  *
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -20,6 +20,7 @@
 extern KSPIN_LOCK PiThreadLock;
 
 VOID PsTerminateCurrentThread(NTSTATUS ExitStatus);
+NTSTATUS STDCALL NtCallTerminatePorts(PETHREAD Thread);
 
 #define TAG_TERMINATE_APC   TAG('T', 'A', 'P', 'C')
 
@@ -135,12 +136,14 @@ PsTerminateCurrentThread(NTSTATUS ExitStatus)
    CurrentThread->ExitStatus = ExitStatus;
    KeQuerySystemTime((PLARGE_INTEGER)&CurrentThread->ExitTime);
    KeCancelTimer(&CurrentThread->Tcb.Timer);
+   
+   KeReleaseSpinLock(&PiThreadLock, oldIrql);
  
+   PsLockProcess(CurrentProcess, FALSE);
    /* Remove the thread from the thread list of its process */
    RemoveEntryList(&CurrentThread->ThreadListEntry);
    Last = IsListEmpty(&CurrentProcess->ThreadListHead);
-
-   KeReleaseSpinLock(&PiThreadLock, oldIrql);
+   PsUnlockProcess(CurrentProcess);
 
    /* Notify subsystems of the thread termination */
    PspRunCreateThreadNotifyRoutines(CurrentThread, FALSE);
@@ -188,6 +191,9 @@ PsTerminateCurrentThread(NTSTATUS ExitStatus)
    /* The last thread shall close the door on exit */
    if(Last)
    {
+    /* save the last thread exit status */
+    CurrentProcess->LastThreadExitStatus = ExitStatus;
+    
     PspRunCreateProcessNotifyRoutines(CurrentProcess, FALSE);
     PsTerminateWin32Process(CurrentProcess);
     PiTerminateProcess(CurrentProcess, ExitStatus);
diff --git a/reactos/ntoskrnl/ps/process.c b/reactos/ntoskrnl/ps/process.c
index 177b8d3c0c3..e20d13aeb96 100644
--- a/reactos/ntoskrnl/ps/process.c
+++ b/reactos/ntoskrnl/ps/process.c
@@ -1,4 +1,4 @@
-/* $Id: process.c,v 1.151 2004/11/13 22:27:15 hbirr Exp $
+/* $Id: process.c,v 1.152 2004/11/20 16:46:05 weiden Exp $
  *
  * COPYRIGHT:         See COPYING in the top level directory
  * PROJECT:           ReactOS kernel
@@ -26,6 +26,7 @@ POBJECT_TYPE EXPORTED PsProcessType = NULL;
 LIST_ENTRY PsProcessListHead;
 static KSPIN_LOCK PsProcessListLock;
 static ULONG PiNextProcessUniqueId = 0; /* TODO */
+static LARGE_INTEGER ShortPsLockDelay, PsLockTimeout;
 
 static GENERIC_MAPPING PiProcessMapping = {PROCESS_READ,
 					   PROCESS_WRITE,
@@ -245,6 +246,8 @@ PsInitProcessManagment(VOID)
    KIRQL oldIrql;
    NTSTATUS Status;
    
+   ShortPsLockDelay.QuadPart = -100LL;
+   PsLockTimeout.QuadPart = -10000000LL; /* one second */
    /*
     * Register the process object type
     */
@@ -314,6 +317,10 @@ PsInitProcessManagment(VOID)
    MmInitializeAddressSpace(PsInitialSystemProcess,
 			    &PsInitialSystemProcess->AddressSpace);
    ObCreateHandleTable(NULL,FALSE,PsInitialSystemProcess);
+   
+   KeInitializeEvent(&PsInitialSystemProcess->LockEvent, SynchronizationEvent, FALSE);
+   PsInitialSystemProcess->LockCount = 0;
+   PsInitialSystemProcess->LockOwner = NULL;
 
 #if defined(__GNUC__)
    KProcess->DirectoryTableBase = 
@@ -329,7 +336,6 @@ PsInitProcessManagment(VOID)
    PsInitialSystemProcess->UniqueProcessId = 
      InterlockedIncrement((LONG *)&PiNextProcessUniqueId); /* TODO */
    PsInitialSystemProcess->Win32WindowStation = (HANDLE)0;
-   PsInitialSystemProcess->Win32Desktop = (HANDLE)0;
    
    KeAcquireSpinLock(&PsProcessListLock, &oldIrql);
    InsertHeadList(&PsProcessListHead, 
@@ -418,6 +424,12 @@ PiDeleteProcess(PVOID ObjectBody)
           KeWaitForSingleObject(&Context.Event, Executive, KernelMode, FALSE, NULL);
 	}
     }
+
+  if(((PEPROCESS)ObjectBody)->Win32Process != NULL)
+  {
+    /* delete the W32PROCESS structure if there's one associated */
+    ExFreePool (((PEPROCESS)ObjectBody)->Win32Process);
+  }
 }
 
 static NTSTATUS
@@ -694,47 +706,13 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
    ObCreateHandleTable(pParentProcess,
 		       InheritObjectTable,
 		       Process);
-   MmCopyMmInfo(pParentProcess, Process);
-   if (pParentProcess->Win32WindowStation != (HANDLE)0)
-     {
-       /* Always duplicate the process window station. */
-       Process->Win32WindowStation = 0;
-       Status = ObDuplicateObject(pParentProcess,
-				  Process,
-				  pParentProcess->Win32WindowStation,
-				  &Process->Win32WindowStation,
-				  0,
-				  FALSE,
-				  DUPLICATE_SAME_ACCESS);
-       if (!NT_SUCCESS(Status))
-	 {
-	   KEBUGCHECK(0);
-	 }
-     }
-   else
-     {
-       Process->Win32WindowStation = (HANDLE)0;
-     }
-   if (pParentProcess->Win32Desktop != (HANDLE)0)
-     {
-       /* Always duplicate the process window station. */
-       Process->Win32Desktop = 0;
-       Status = ObDuplicateObject(pParentProcess,
-				  Process,
-				  pParentProcess->Win32Desktop,
-				  &Process->Win32Desktop,
-				  0,
-				  FALSE,
-				  DUPLICATE_SAME_ACCESS);
-       if (!NT_SUCCESS(Status))
-	 {
-	   KEBUGCHECK(0);
-	 }
-     }
-   else
-     {
-       Process->Win32Desktop = (HANDLE)0;
-     }
+   MmCopyMmInfo(ParentProcess, Process);
+   
+   KeInitializeEvent(&Process->LockEvent, SynchronizationEvent, FALSE);
+   Process->LockCount = 0;
+   Process->LockOwner = NULL;
+   
+   Process->Win32WindowStation = (HANDLE)0;
 
    KeAcquireSpinLock(&PsProcessListLock, &oldIrql);
    InsertHeadList(&PsProcessListHead, &Process->ProcessListEntry);
@@ -1381,11 +1359,6 @@ NtSetInformationProcess(IN HANDLE ProcessHandle,
       case ProcessWow64Information:
       default:
 	Status = STATUS_INVALID_INFO_CLASS;
-
-     case ProcessDesktop:
-       Process->Win32Desktop = *(PHANDLE)ProcessInformation;
-       Status = STATUS_SUCCESS;
-       break;
      }
    ObDereferenceObject(Process);
    return(Status);
@@ -1977,7 +1950,7 @@ PsSetProcessSecurityPort(
 
 /*
  * @implemented
- */                       
+ */
 VOID
 STDCALL
 PsSetProcessWin32Process(
@@ -1990,7 +1963,7 @@ PsSetProcessWin32Process(
 
 /*
  * @implemented
- */                       
+ */
 VOID
 STDCALL
 PsSetProcessWin32WindowStation(
@@ -2151,4 +2124,76 @@ PsReturnProcessPagedPoolQuota(
 {
 	UNIMPLEMENTED;
 }
+
+NTSTATUS
+PsLockProcess(PEPROCESS Process, BOOL Timeout)
+{
+  ULONG Attempts = 0;
+  PKTHREAD PrevLockOwner;
+  NTSTATUS Status = STATUS_UNSUCCESSFUL;
+  PLARGE_INTEGER Delay = (Timeout ? &PsLockTimeout : NULL);
+  PKTHREAD CallingThread = KeGetCurrentThread();
+  
+  KeEnterCriticalRegion();
+  
+  for(;;)
+  {
+    if(Process->Pcb.State == PROCESS_STATE_TERMINATED)
+    {
+      KeLeaveCriticalRegion();
+      return STATUS_PROCESS_IS_TERMINATING;
+    }
+
+    /* FIXME - why don't we have InterlockedCompareExchangePointer in ntoskrnl?! */
+    PrevLockOwner = (PKTHREAD)InterlockedCompareExchange((LONG*)&Process->LockOwner, (LONG)CallingThread, (LONG)NULL);
+    if(PrevLockOwner == NULL || PrevLockOwner == CallingThread)
+    {
+      /* we got the lock or already locked it */
+      if(InterlockedIncrement((LONG*)&Process->LockCount) == 1)
+      {
+        KeClearEvent(&Process->LockEvent);
+      }
+
+      return STATUS_SUCCESS;
+    }
+    else
+    {
+      if(++Attempts > 2)
+      {
+        Status = KeWaitForSingleObject(&Process->LockEvent,
+                                       Executive,
+                                       KernelMode,
+                                       FALSE,
+                                       Delay);
+        if(Status == STATUS_TIMEOUT)
+        {
+          KeLeaveCriticalRegion();
+          break;
+        }
+      }
+      else
+      {
+        KeDelayExecutionThread(KernelMode, FALSE, &ShortPsLockDelay);
+      }
+    }
+  }
+  
+  return Status;
+}
+
+VOID
+PsUnlockProcess(PEPROCESS Process)
+{
+  assert(Process->LockOwner == KeGetCurrentThread());
+  
+  if(InterlockedDecrement((LONG*)&Process->LockCount) == 0)
+  {
+    /* FIXME - why don't we have InterlockedExchangePointer in ntoskrnl?! */
+    InterlockedExchange((LONG*)&Process->LockOwner, (LONG)NULL);
+    KeSetEvent(&Process->LockEvent, IO_NO_INCREMENT, FALSE);
+  }
+  
+  KeLeaveCriticalRegion();
+}
+
 /* EOF */
diff --git a/reactos/ntoskrnl/ps/win32.c b/reactos/ntoskrnl/ps/win32.c
index b3a61941381..9d14bee1a1d 100644
--- a/reactos/ntoskrnl/ps/win32.c
+++ b/reactos/ntoskrnl/ps/win32.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: win32.c,v 1.9 2004/09/28 15:02:29 weiden Exp $
+/* $Id: win32.c,v 1.10 2004/11/20 16:46:05 weiden Exp $
  *
  * COPYRIGHT:              See COPYING in the top level directory
  * PROJECT:                ReactOS kernel
@@ -100,17 +100,20 @@ PsInitWin32Thread (PETHREAD Thread)
 
   if (Process->Win32Process == NULL)
     {
+      /* FIXME - lock the process */
       Process->Win32Process = ExAllocatePool (NonPagedPool,
 					      PspWin32ProcessSize);
+
       if (Process->Win32Process == NULL)
 	return STATUS_NO_MEMORY;
 
       RtlZeroMemory (Process->Win32Process,
 		     PspWin32ProcessSize);
+      /* FIXME - unlock the process */
 
       if (PspWin32ProcessCallback != NULL)
 	{
-	  PspWin32ProcessCallback (Process, TRUE);
+          PspWin32ProcessCallback (Process, TRUE);
 	}
     }
 
@@ -145,7 +148,8 @@ PsTerminateWin32Process (PEPROCESS Process)
       PspWin32ProcessCallback (Process, FALSE);
     }
 
-  ExFreePool (Process->Win32Process);
+  /* don't delete the W32PROCESS structure at this point, wait until the
+     EPROCESS structure is being freed */
 }
 
 
@@ -159,7 +163,8 @@ PsTerminateWin32Thread (PETHREAD Thread)
       PspWin32ThreadCallback (Thread, FALSE);
     }
 
-    ExFreePool (Thread->Tcb.Win32Thread);
+    /* don't delete the W32THREAD structure at this point, wait until the
+       ETHREAD structure is being freed */
   }
 }
 
diff --git a/reactos/subsys/csrss/win32csr/desktopbg.c b/reactos/subsys/csrss/win32csr/desktopbg.c
index ed98d2e76be..546ef6be37e 100644
--- a/reactos/subsys/csrss/win32csr/desktopbg.c
+++ b/reactos/subsys/csrss/win32csr/desktopbg.c
@@ -1,4 +1,4 @@
-/* $Id: desktopbg.c,v 1.10 2004/09/24 15:07:38 navaraf Exp $
+/* $Id: desktopbg.c,v 1.11 2004/11/20 16:46:05 weiden Exp $
  *
  * reactos/subsys/csrss/win32csr/desktopbg.c
  *
@@ -72,7 +72,7 @@ DtbgWindowProc(HWND Wnd, UINT Msg, WPARAM wParam, LPARAM lParam)
         PAINTSTRUCT PS;
         RECT rc;
         HDC hDC;
-        
+
         if(GetUpdateRect(Wnd, &rc, FALSE) &&
            (hDC = BeginPaint(Wnd, &PS)))
         {
@@ -94,7 +94,7 @@ DtbgWindowProc(HWND Wnd, UINT Msg, WPARAM wParam, LPARAM lParam)
       case WM_NOTIFY:
       {
         PPRIVATE_NOTIFY_DESKTOP nmh = (PPRIVATE_NOTIFY_DESKTOP)lParam;
-        
+
         /* Use WM_NOTIFY for private messages since it can't be sent between
            processes! */
         switch(nmh->hdr.code)
@@ -125,7 +125,7 @@ DtbgWindowProc(HWND Wnd, UINT Msg, WPARAM wParam, LPARAM lParam)
             VisibleDesktopWindow = NULL;
             return Result;
           }
-          
+
           default:
             DPRINT("Unknown notification code 0x%x sent to the desktop window!\n", nmh->code);
             return 0;
@@ -140,23 +140,9 @@ static BOOL FASTCALL
 DtbgInit()
 {
   WNDCLASSEXW Class;
-  HWINSTA WindowStation;
   ATOM ClassAtom;
 
-  /* Attach to window station */
-  WindowStation = OpenWindowStationW(L"WinSta0", FALSE, GENERIC_ALL);
-  if (NULL == WindowStation)
-    {
-      DPRINT1("Failed to open window station\n");
-      return FALSE;
-    }
-  if (! SetProcessWindowStation(WindowStation))
-    {
-      DPRINT1("Failed to set process window station\n");
-      return FALSE;
-    }
-
-  /* 
+  /*
    * Create the desktop window class
    */
   Class.cbSize = sizeof(WNDCLASSEXW);
@@ -229,7 +215,6 @@ DtbgDesktopThread(PVOID Data)
 
 CSR_API(CsrCreateDesktop)
 {
-  HDESK Desktop;
   DTBG_THREAD_DATA ThreadData;
   HANDLE ThreadHandle;
 
@@ -247,16 +232,11 @@ CSR_API(CsrCreateDesktop)
         }
     }
 
-  Desktop = OpenDesktopW(Request->Data.CreateDesktopRequest.DesktopName,
-                         0, FALSE, GENERIC_ALL);
-  if (NULL == Desktop)
-    {
-      DPRINT1("Failed to open desktop %S\n",
-              Request->Data.CreateDesktopRequest.DesktopName);
-      return Reply->Status = STATUS_UNSUCCESSFUL;
-    }
+  /*
+   * the desktop handle we got from win32k is in the scope of CSRSS so we can just use it
+   */
+  ThreadData.Desktop = Request->Data.CreateDesktopRequest.DesktopHandle;
 
-  ThreadData.Desktop = Desktop;
   ThreadData.Event = CreateEventW(NULL, FALSE, FALSE, NULL);
   if (NULL == ThreadData.Event)
     {
@@ -296,7 +276,7 @@ CSR_API(CsrShowDesktop)
   nmh.hdr.hwndFrom = Request->Data.ShowDesktopRequest.DesktopWindow;
   nmh.hdr.idFrom = 0;
   nmh.hdr.code = PM_SHOW_DESKTOP;
-  
+
   nmh.ShowDesktop.Width = (int)Request->Data.ShowDesktopRequest.Width;
   nmh.ShowDesktop.Height = (int)Request->Data.ShowDesktopRequest.Height;
 
diff --git a/reactos/subsys/csrss/win32csr/guiconsole.c b/reactos/subsys/csrss/win32csr/guiconsole.c
index 4de20782305..c15a3ff8677 100644
--- a/reactos/subsys/csrss/win32csr/guiconsole.c
+++ b/reactos/subsys/csrss/win32csr/guiconsole.c
@@ -1,4 +1,4 @@
-/* $Id: guiconsole.c,v 1.21 2004/09/26 15:55:53 weiden Exp $
+/* $Id: guiconsole.c,v 1.22 2004/11/20 16:46:05 weiden Exp $
  *
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS system libraries
@@ -875,31 +875,8 @@ GuiConsoleGuiThread(PVOID Data)
 static BOOL FASTCALL
 GuiInit(VOID)
 {
-  HDESK Desktop;
-  NTSTATUS Status;
   WNDCLASSEXW wc;
 
-  Desktop = OpenDesktopW(L"Default", 0, FALSE, GENERIC_ALL);
-  if (NULL == Desktop)
-    {
-      DPRINT1("Failed to open desktop\n");
-      return FALSE;
-    }
-  Status = NtSetInformationProcess(NtCurrentProcess(),
-                                   ProcessDesktop,
-                                   &Desktop,
-                                   sizeof(Desktop));
-  if (!NT_SUCCESS(Status))
-    {
-      DPRINT1("Cannot set default desktop.\n");
-      return FALSE;
-    }
-  if (! SetThreadDesktop(Desktop))
-    {
-      DPRINT1("Failed to set thread desktop\n");
-      return FALSE;
-    }
-
   if (NULL == NotifyWnd)
     {
       PrivateCsrssManualGuiCheck(+1);
diff --git a/reactos/subsys/system/winlogon/winlogon.c b/reactos/subsys/system/winlogon/winlogon.c
index f06e01fef03..3c9ddaf260b 100644
--- a/reactos/subsys/system/winlogon/winlogon.c
+++ b/reactos/subsys/system/winlogon/winlogon.c
@@ -1,4 +1,4 @@
-/* $Id: winlogon.c,v 1.36 2004/11/20 15:55:45 ekohl Exp $
+/* $Id: winlogon.c,v 1.37 2004/11/20 16:46:05 weiden Exp $
  * 
  * COPYRIGHT:       See COPYING in the top level directory
  * PROJECT:         ReactOS kernel
@@ -555,7 +555,6 @@ WinMain(HINSTANCE hInstance,
   LSA_OPERATIONAL_MODE Mode;
   ULONG AuthenticationPackage;
 #endif
-  NTSTATUS Status;
 
   hAppInstance = hInstance;
   
@@ -598,14 +597,6 @@ WinMain(HINSTANCE hInstance,
    * Switch to winlogon desktop
    */
   /* FIXME: Do start up in the application desktop for now. */
-  Status = NtSetInformationProcess(NtCurrentProcess(),
-                                   ProcessDesktop,
-                                   &WLSession->ApplicationDesktop,
-                                   sizeof(HDESK));
-  if(!NT_SUCCESS(Status))
-  {
-    DbgPrint("WL: Cannot set default desktop for winlogon.\n");
-  }
   SetThreadDesktop(WLSession->ApplicationDesktop);
   if(!SwitchDesktop(WLSession->ApplicationDesktop))
   {
diff --git a/reactos/subsys/win32k/include/csr.h b/reactos/subsys/win32k/include/csr.h
index dd8e1b783c9..71f1a26ed78 100644
--- a/reactos/subsys/win32k/include/csr.h
+++ b/reactos/subsys/win32k/include/csr.h
@@ -1,4 +1,4 @@
-/* $Id: csr.h,v 1.1 2004/05/28 21:33:41 gvg Exp $
+/* $Id: csr.h,v 1.2 2004/11/20 16:46:05 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -10,8 +10,12 @@
 #ifndef CSR_H_INCLUDED
 #define CSR_H_INCLUDED
 
+extern PEPROCESS CsrProcess;
+
 extern NTSTATUS FASTCALL CsrInit(void);
 extern NTSTATUS FASTCALL CsrNotify(PCSRSS_API_REQUEST Request, PCSRSS_API_REPLY Reply);
+extern NTSTATUS FASTCALL CsrCloseHandle(HANDLE Handle);
+extern NTSTATUS STDCALL CsrInsertObject(PVOID, PACCESS_STATE, ACCESS_MASK, ULONG, PVOID*, PHANDLE);
 
 #endif /* CSR_H_INCLUDED */
 
diff --git a/reactos/subsys/win32k/include/desktop.h b/reactos/subsys/win32k/include/desktop.h
index 37292dc94a6..43eee13b8fb 100644
--- a/reactos/subsys/win32k/include/desktop.h
+++ b/reactos/subsys/win32k/include/desktop.h
@@ -59,6 +59,12 @@ IntValidateDesktopHandle(
    ACCESS_MASK DesiredAccess,
    PDESKTOP_OBJECT *Object);
 
+NTSTATUS FASTCALL
+IntParseDesktopPath(PEPROCESS Process,
+                    PUNICODE_STRING DesktopPath,
+                    HWINSTA *hWinSta,
+                    HDESK *hDesktop);
+
 #define IntIsActiveDesktop(Desktop) \
   ((Desktop)->WindowStation->ActiveDesktop == (Desktop))
 
diff --git a/reactos/subsys/win32k/include/menu.h b/reactos/subsys/win32k/include/menu.h
index 5c421b86815..3a25fa3e2ca 100644
--- a/reactos/subsys/win32k/include/menu.h
+++ b/reactos/subsys/win32k/include/menu.h
@@ -33,7 +33,7 @@ typedef struct _MENU_ITEM
 
 typedef struct _MENU_OBJECT
 {
-  PW32PROCESS W32Process;
+  PEPROCESS Process;
   LIST_ENTRY ListEntry;
   FAST_MUTEX MenuItemsLock;
   PMENU_ITEM MenuItemList;
diff --git a/reactos/subsys/win32k/include/window.h b/reactos/subsys/win32k/include/window.h
index de9d949f34b..616c199b65b 100644
--- a/reactos/subsys/win32k/include/window.h
+++ b/reactos/subsys/win32k/include/window.h
@@ -129,7 +129,7 @@ typedef struct _WINDOW_OBJECT
   (hWnd == HWND_BROADCAST || hWnd == HWND_TOPMOST)
 
 #define IntGetWindowObject(hWnd) \
-  IntGetProcessWindowObject(PsGetWin32Process(), hWnd)
+  IntGetProcessWindowObject(PsGetWin32Thread(), hWnd)
 
 #define IntReferenceWindowObject(WndObj) \
   ObmReferenceObjectByPointer(WndObj, otWindow)
@@ -161,7 +161,7 @@ typedef struct _WINDOW_OBJECT
 
 
 PWINDOW_OBJECT FASTCALL
-IntGetProcessWindowObject(PW32PROCESS ProcessData, HWND hWnd);
+IntGetProcessWindowObject(PW32THREAD Thread, HWND hWnd);
 
 BOOL FASTCALL
 IntIsWindow(HWND hWnd);
diff --git a/reactos/subsys/win32k/include/winsta.h b/reactos/subsys/win32k/include/winsta.h
index c0e2fff1686..5b57c075c62 100644
--- a/reactos/subsys/win32k/include/winsta.h
+++ b/reactos/subsys/win32k/include/winsta.h
@@ -6,12 +6,6 @@
 #include <internal/ex.h>
 #include <internal/ps.h>
 #include "msgqueue.h"
-
-#define PROCESS_WINDOW_STATION() \
-  ((HWINSTA)(IoGetCurrentProcess()->Win32WindowStation))
-
-#define SET_PROCESS_WINDOW_STATION(WinSta) \
-  ((IoGetCurrentProcess()->Win32WindowStation) = (PVOID)(WinSta))
   
 #define WINSTA_ROOT_NAME	L"\\Windows\\WindowStations"
 #define WINSTA_ROOT_NAME_LENGTH	23
@@ -51,6 +45,8 @@ IntGetFullWindowStationName(
    IN PUNICODE_STRING WinStaName,
    IN OPTIONAL PUNICODE_STRING DesktopName);
 
+PWINSTATION_OBJECT FASTCALL IntGetWinStaObj(VOID);
+
 #endif /* _WIN32K_WINSTA_H */
 
 /* EOF */
diff --git a/reactos/subsys/win32k/main/dllmain.c b/reactos/subsys/win32k/main/dllmain.c
index f5b1c8c6ba7..55dda051ad5 100644
--- a/reactos/subsys/win32k/main/dllmain.c
+++ b/reactos/subsys/win32k/main/dllmain.c
@@ -16,12 +16,15 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: dllmain.c,v 1.81 2004/11/16 16:27:48 blight Exp $
+/* $Id: dllmain.c,v 1.82 2004/11/20 16:46:05 weiden Exp $
  *
  *  Entry Point for win32k.sys
  */
 #include <w32k.h>
-#include <roscfg.h>
+
+#define NDEBUG
+#include <win32k/debug1.h>
+#include <debug.h>
 
 #ifdef __USE_W32API
 typedef NTSTATUS (STDCALL *PW32_PROCESS_CALLBACK)(
@@ -51,18 +54,11 @@ Win32kProcessCallback (struct _EPROCESS *Process,
 		     BOOLEAN Create)
 {
   PW32PROCESS Win32Process;
-  NTSTATUS Status;
-
-#if 0
-  DbgPrint ("Win32kProcessCallback() called\n");
-#endif
-
+  
   Win32Process = Process->Win32Process;
   if (Create)
     {
-#if 0
-      DbgPrint ("  Create process\n");
-#endif
+      DPRINT("Creating W32 process PID:%d at IRQ level: %lu\n", Process->UniqueProcessId, KeGetCurrentIrql());
 
       InitializeListHead(&Win32Process->ClassListHead);
       ExInitializeFastMutex(&Win32Process->ClassListLock);
@@ -77,31 +73,14 @@ Win32kProcessCallback (struct _EPROCESS *Process,
       ExInitializeFastMutex(&Win32Process->CursorIconListLock);
 
       Win32Process->KeyboardLayout = W32kGetDefaultKeyLayout();
-      Win32Process->WindowStation = NULL;
-      if (Process->Win32WindowStation != NULL)
-	{
-	  Status = 
-	    IntValidateWindowStationHandle(Process->Win32WindowStation,
-					   UserMode,
-					   GENERIC_ALL,
-					   &Win32Process->WindowStation);
-	  if (!NT_SUCCESS(Status))
-	    {
-	      DbgPrint("Win32K: Failed to reference a window station for "
-		       "process.\n");
-	    }
-	}
       
       /* setup process flags */
       Win32Process->Flags = 0;
     }
   else
     {
-#if 0
-      DbgPrint ("  Destroy process\n");
-      DbgPrint ("  IRQ level: %lu\n", KeGetCurrentIrql ());
-#endif
-	  IntRemoveProcessWndProcHandles((HANDLE)Process->UniqueProcessId);
+      DPRINT("Destroying W32 process PID:%d at IRQ level: %lu\n", Process->UniqueProcessId, KeGetCurrentIrql());
+      IntRemoveProcessWndProcHandles((HANDLE)Process->UniqueProcessId);
       IntCleanupMenus(Process, Win32Process);
       IntCleanupCurIcons(Process, Win32Process);
       CleanupMonitorImpl();
@@ -129,19 +108,63 @@ Win32kThreadCallback (struct _ETHREAD *Thread,
 {
   struct _EPROCESS *Process;
   PW32THREAD Win32Thread;
-  NTSTATUS Status;
-
-#if 0
-  DbgPrint ("Win32kThreadCallback() called\n");
-#endif
 
   Process = Thread->ThreadsProcess;
   Win32Thread = Thread->Tcb.Win32Thread;
   if (Create)
     {
-#if 0
-      DbgPrint ("  Create thread\n");
-#endif
+      HWINSTA hWinSta = NULL;
+      HDESK hDesk = NULL;
+      NTSTATUS Status;
+      PUNICODE_STRING DesktopPath;
+      PRTL_USER_PROCESS_PARAMETERS ProcessParams = (Process->Peb ? Process->Peb->ProcessParameters : NULL);
+
+      DPRINT("Creating W32 thread TID:%d at IRQ level: %lu\n", Thread->Cid.UniqueThread, KeGetCurrentIrql());
+      
+      /*
+       * inherit the thread desktop and process window station (if not yet inherited) from the process startup
+       * info structure. See documentation of CreateProcess()
+       */
+      DesktopPath = (ProcessParams ? ((ProcessParams->DesktopInfo.Length > 0) ? &ProcessParams->DesktopInfo : NULL) : NULL);
+      Status = IntParseDesktopPath(Process,
+                                   DesktopPath,
+                                   &hWinSta,
+                                   &hDesk);
+      if(NT_SUCCESS(Status))
+      {
+        if(hWinSta != NULL)
+        {
+          if(Process != CsrProcess)
+          {
+            HWINSTA hProcessWinSta = (HWINSTA)InterlockedCompareExchangePointer((PVOID)&Process->Win32WindowStation, (PVOID)hWinSta, NULL);
+            if(hProcessWinSta != NULL)
+            {
+              /* our process is already assigned to a different window station, we don't need the handle anymore */
+              NtClose(hWinSta);
+            }
+          }
+          else
+          {
+            NtClose(hWinSta);
+          }
+        }
+
+        Win32Thread->hDesktop = hDesk;
+
+        Status = ObReferenceObjectByHandle(hDesk,
+                 0,
+                 ExDesktopObjectType,
+                 KernelMode,
+                 (PVOID*)&Win32Thread->Desktop,
+                 NULL);
+
+        if(!NT_SUCCESS(Status))
+        {
+          DPRINT1("Unable to reference thread desktop handle 0x%x\n", hDesk);
+          Win32Thread->Desktop = NULL;
+          NtClose(hDesk);
+        }
+      }
 
       Win32Thread->IsExiting = FALSE;
       IntDestroyCaret(Win32Thread);
@@ -152,31 +175,10 @@ Win32kThreadCallback (struct _ETHREAD *Thread,
       ExInitializeFastMutex(&Win32Thread->WindowListLock);
       InitializeListHead(&Win32Thread->W32CallbackListHead);
       ExInitializeFastMutex(&Win32Thread->W32CallbackListLock);
-
-      /* By default threads get assigned their process's desktop. */
-      Win32Thread->Desktop = NULL;
-      Win32Thread->hDesktop = NULL;
-      if (Process->Win32Desktop != NULL)
-	{
-	  Status = ObReferenceObjectByHandle(Process->Win32Desktop,
-					     GENERIC_ALL,
-					     ExDesktopObjectType,
-					     UserMode,
-					     (PVOID*)&Win32Thread->Desktop,
-					     NULL);
-	  if (!NT_SUCCESS(Status))
-	    {
-	      DbgPrint("Win32K: Failed to reference a desktop for thread.\n");
-	    }
-	  
-	  Win32Thread->hDesktop = Process->Win32Desktop;
-	}
     }
   else
     {
-#if 0
-      DbgPrint ("  Destroy thread\n");
-#endif
+      DPRINT("Destroying W32 thread TID:%d at IRQ level: %lu\n", Thread->Cid.UniqueThread, KeGetCurrentIrql());
 
       Win32Thread->IsExiting = TRUE;
       HOOK_DestroyThreadHooks(Thread);
@@ -186,6 +188,10 @@ Win32kThreadCallback (struct _ETHREAD *Thread,
       IntBlockInput(Win32Thread, FALSE);
       MsqDestroyMessageQueue(Win32Thread->MessageQueue);
       IntCleanupThreadCallbacks(Win32Thread);
+      if(Win32Thread->Desktop != NULL)
+      {
+        ObDereferenceObject(Win32Thread->Desktop);
+      }
     }
 
   return STATUS_SUCCESS;
@@ -215,7 +221,7 @@ DllMain (
 				    1);
   if (Result == FALSE)
     {
-      DbgPrint("Adding system services failed!\n");
+      DPRINT1("Adding system services failed!\n");
       return STATUS_UNSUCCESSFUL;
     }
 
@@ -232,49 +238,49 @@ DllMain (
   Status = InitWindowStationImpl();
   if (!NT_SUCCESS(Status))
   {
-    DbgPrint("Failed to initialize window station implementation!\n");
+    DPRINT1("Failed to initialize window station implementation!\n");
     return STATUS_UNSUCCESSFUL;
   }
 
   Status = InitClassImpl();
   if (!NT_SUCCESS(Status))
   {
-    DbgPrint("Failed to initialize window class implementation!\n");
+    DPRINT1("Failed to initialize window class implementation!\n");
     return STATUS_UNSUCCESSFUL;
   }
 
   Status = InitDesktopImpl();
   if (!NT_SUCCESS(Status))
   {
-    DbgPrint("Failed to initialize desktop implementation!\n");
+    DPRINT1("Failed to initialize desktop implementation!\n");
     return STATUS_UNSUCCESSFUL;
   }
 
   Status = InitWindowImpl();
   if (!NT_SUCCESS(Status))
   {
-    DbgPrint("Failed to initialize window implementation!\n");
+    DPRINT1("Failed to initialize window implementation!\n");
     return STATUS_UNSUCCESSFUL;
   }
 
   Status = InitMenuImpl();
   if (!NT_SUCCESS(Status))
   {
-    DbgPrint("Failed to initialize menu implementation!\n");
+    DPRINT1("Failed to initialize menu implementation!\n");
     return STATUS_UNSUCCESSFUL;
   }
 
   Status = InitInputImpl();
   if (!NT_SUCCESS(Status))
     {
-      DbgPrint("Failed to initialize input implementation.\n");
+      DPRINT1("Failed to initialize input implementation.\n");
       return(Status);
     }
 
   Status = InitKeyboardImpl();
   if (!NT_SUCCESS(Status))
     {
-      DbgPrint("Failed to initialize keyboard implementation.\n");
+      DPRINT1("Failed to initialize keyboard implementation.\n");
       return(Status);
     }
 
@@ -288,28 +294,28 @@ DllMain (
   Status = MsqInitializeImpl();
   if (!NT_SUCCESS(Status))
     {
-      DbgPrint("Failed to initialize message queue implementation.\n");
+      DPRINT1("Failed to initialize message queue implementation.\n");
       return(Status);
     }
 
   Status = InitTimerImpl();
   if (!NT_SUCCESS(Status))
     {
-      DbgPrint("Failed to initialize timer implementation.\n");
+      DPRINT1("Failed to initialize timer implementation.\n");
       return(Status);
     }
 
   Status = InitAcceleratorImpl();
   if (!NT_SUCCESS(Status))
     {
-      DbgPrint("Failed to initialize accelerator implementation.\n");
+      DPRINT1("Failed to initialize accelerator implementation.\n");
       return(Status);
     }
 
   Status = InitGuiCheckImpl();
   if (!NT_SUCCESS(Status))
     {
-      DbgPrint("Failed to initialize GUI check implementation.\n");
+      DPRINT1("Failed to initialize GUI check implementation.\n");
       return(Status);
     }
 
diff --git a/reactos/subsys/win32k/ntuser/caret.c b/reactos/subsys/win32k/ntuser/caret.c
index 3cee09d61ed..2d9b51f854a 100644
--- a/reactos/subsys/win32k/ntuser/caret.c
+++ b/reactos/subsys/win32k/ntuser/caret.c
@@ -1,4 +1,4 @@
-/* $Id: caret.c,v 1.14 2004/08/04 22:31:17 weiden Exp $
+/* $Id: caret.c,v 1.15 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -54,18 +54,7 @@ BOOL FASTCALL
 IntSetCaretBlinkTime(UINT uMSeconds)
 {
   /* Don't save the new value to the registry! */
-  NTSTATUS Status;
-  PWINSTATION_OBJECT WinStaObject;
-  
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-	                                  KernelMode,
-				          0,
-				          &WinStaObject);
-  if(!NT_SUCCESS(Status))
-  {
-    SetLastNtError(Status);
-    return FALSE;
-  }
+  PWINSTATION_OBJECT WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
   
   /* windows doesn't do this check */
   if((uMSeconds < MIN_CARETBLINKRATE) || (uMSeconds > MAX_CARETBLINKRATE))
@@ -77,7 +66,6 @@ IntSetCaretBlinkTime(UINT uMSeconds)
   
   WinStaObject->CaretBlinkRate = uMSeconds;
   
-  ObDereferenceObject(WinStaObject);
   return TRUE;
 }
 
@@ -151,19 +139,10 @@ IntQueryCaretBlinkRate(VOID)
 UINT FASTCALL
 IntGetCaretBlinkTime(VOID)
 {
-  NTSTATUS Status;
   PWINSTATION_OBJECT WinStaObject;
   UINT Ret;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-	                                  KernelMode,
-				          0,
-				          &WinStaObject);
-  if(!NT_SUCCESS(Status))
-  {
-    SetLastNtError(Status);
-    return 0;
-  }
+  WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
   
   Ret = WinStaObject->CaretBlinkRate;
   if(!Ret)
@@ -178,7 +157,6 @@ IntGetCaretBlinkTime(VOID)
     Ret = DEFAULT_CARETBLINKRATE;
   }
   
-  ObDereferenceObject(WinStaObject);
   return Ret;
 }
 
diff --git a/reactos/subsys/win32k/ntuser/class.c b/reactos/subsys/win32k/ntuser/class.c
index 6de093a39b7..030bb379e5f 100644
--- a/reactos/subsys/win32k/ntuser/class.c
+++ b/reactos/subsys/win32k/ntuser/class.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: class.c,v 1.59 2004/06/21 20:56:53 hbirr Exp $
+/* $Id: class.c,v 1.60 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -99,21 +99,10 @@ ClassReferenceClassByName(
    BOOL Found;
    RTL_ATOM ClassAtom;
 
-   if (!ClassName)
+   if (!ClassName || !PsGetWin32Thread()->Desktop)
       return FALSE;
 
-   Status = IntValidateWindowStationHandle(
-      PROCESS_WINDOW_STATION(),
-      KernelMode,
-      0,
-      &WinStaObject);
-
-   if (!NT_SUCCESS(Status))
-   {
-      DPRINT("Validation of window station handle (0x%X) failed\n",
-	     PROCESS_WINDOW_STATION());
-      return FALSE;
-   }
+   WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
 
    Status = RtlLookupAtomInAtomTable(
       WinStaObject->AtomTable,
@@ -122,12 +111,10 @@ ClassReferenceClassByName(
 
    if (!NT_SUCCESS(Status))
    {
-      ObDereferenceObject(WinStaObject);  
       return FALSE;
    }
 
    Found = ClassReferenceClassByAtom(Class, ClassAtom, hInstance);
-   ObDereferenceObject(WinStaObject);  
 
    return Found;
 }
@@ -205,14 +192,13 @@ IntGetClassName(struct _WINDOW_OBJECT *WindowObject, LPWSTR lpClassName,
    PWINSTATION_OBJECT WinStaObject;
    NTSTATUS Status;
 
-   Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-      KernelMode, 0, &WinStaObject);
-   if (!NT_SUCCESS(Status))
+   if(!PsGetWin32Thread()->Desktop)
    {
-      DPRINT("Validation of window station handle (0x%X) failed\n",
-         PROCESS_WINDOW_STATION());
       return 0;
    }
+
+   WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
+   
    Length = 0;
    Status = RtlQueryAtomInAtomTable(WinStaObject->AtomTable,
       WindowObject->Class->Atom, NULL, NULL, NULL, &Length);
@@ -233,7 +219,6 @@ IntGetClassName(struct _WINDOW_OBJECT *WindowObject, LPWSTR lpClassName,
    /* FIXME: Check buffer size before doing this! */
    *(lpClassName + Length) = 0;
    ExFreePool(Name);
-   ObDereferenceObject(WinStaObject);
 
    return Length;
 }
@@ -426,18 +411,8 @@ NtUserRegisterClassExWOW(
       return (RTL_ATOM)0;
    }
   
-  DPRINT("About to open window station handle (0x%X)\n", 
-    PROCESS_WINDOW_STATION());
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-    KernelMode,
-    0,
-    &WinStaObject);
-  if (!NT_SUCCESS(Status))
-  {
-    DPRINT("Validation of window station handle (0x%X) failed\n",
-      PROCESS_WINDOW_STATION());
-    return((RTL_ATOM)0);
-  }
+  WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
+  
   if (ClassName->Length)
   {
     DPRINT("NtUserRegisterClassExWOW(%S)\n", ClassName->Buffer);
@@ -447,7 +422,6 @@ NtUserRegisterClassExWOW(
       &Atom);
     if (!NT_SUCCESS(Status))
     {
-      ObDereferenceObject(WinStaObject);
       DPRINT("Failed adding class name (%S) to atom table\n",
 	ClassName->Buffer);
       SetLastNtError(Status);      
@@ -465,14 +439,12 @@ NtUserRegisterClassExWOW(
     {
       RtlDeleteAtomFromAtomTable(WinStaObject->AtomTable, Atom);
     }
-    ObDereferenceObject(WinStaObject);
     DPRINT("Failed creating window class object\n");
     return((RTL_ATOM)0);
   }
   IntLockProcessClasses(PsGetWin32Process());
   InsertTailList(&PsGetWin32Process()->ClassListHead, &ClassObject->ListEntry);
   IntUnLockProcessClasses(PsGetWin32Process());
-  ObDereferenceObject(WinStaObject);
   return(Atom);
 }
 
@@ -668,32 +640,21 @@ NtUserUnregisterClass(
 	 HINSTANCE hInstance,
 	 DWORD Unknown)
 {
-   NTSTATUS Status;
    PWNDCLASS_OBJECT Class;
    PWINSTATION_OBJECT WinStaObject;
   
    DPRINT("NtUserUnregisterClass(%S)\n", ClassNameOrAtom);
    
-   if (!ClassNameOrAtom)
+   if (!ClassNameOrAtom || !PsGetWin32Thread()->Desktop)
    {
       SetLastWin32Error(ERROR_INVALID_PARAMETER);
       return FALSE;
    }
   
-   Status = IntValidateWindowStationHandle(
-      PROCESS_WINDOW_STATION(),
-      KernelMode,
-      0,
-      &WinStaObject);
-   if (!NT_SUCCESS(Status))
-   {
-      SetLastWin32Error(ERROR_INVALID_HANDLE);
-      return FALSE;
-   }
+   WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
 
    if (!ClassReferenceClassByNameOrAtom(&Class, ClassNameOrAtom, hInstance))
    {
-      ObDereferenceObject(WinStaObject);
       SetLastWin32Error(ERROR_CLASS_DOES_NOT_EXIST);
       return FALSE;
    }
@@ -701,7 +662,6 @@ NtUserUnregisterClass(
    if (Class->hInstance && Class->hInstance != hInstance)
    {
       ClassDereferenceObject(Class);
-      ObDereferenceObject(WinStaObject);
       SetLastWin32Error(ERROR_CLASS_DOES_NOT_EXIST);
       return FALSE;
    }
@@ -712,7 +672,6 @@ NtUserUnregisterClass(
       IntUnLockClassWindows(Class);
       /* Dereference the ClassReferenceClassByNameOrAtom() call */
       ObmDereferenceObject(Class);
-      ObDereferenceObject(WinStaObject);
       SetLastWin32Error(ERROR_CLASS_HAS_WINDOWS);
       return FALSE;
    }
@@ -727,8 +686,6 @@ NtUserUnregisterClass(
   
    /* Free the object */
    ClassDereferenceObject(Class);
-   
-   ObDereferenceObject(WinStaObject);
   
    return TRUE;
 }
diff --git a/reactos/subsys/win32k/ntuser/csr.c b/reactos/subsys/win32k/ntuser/csr.c
index e42d650ebec..b5e4d30e96a 100644
--- a/reactos/subsys/win32k/ntuser/csr.c
+++ b/reactos/subsys/win32k/ntuser/csr.c
@@ -1,4 +1,4 @@
-/* $Id: csr.c,v 1.2 2004/07/12 20:09:35 gvg Exp $
+/* $Id: csr.c,v 1.3 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -10,7 +10,7 @@
 #include <w32k.h>
 
 static HANDLE WindowsApiPort = NULL;
-static PEPROCESS CsrProcess = NULL;
+PEPROCESS CsrProcess = NULL;
 
 NTSTATUS FASTCALL
 CsrInit(void)
@@ -76,4 +76,60 @@ CsrNotify(PCSRSS_API_REQUEST Request, PCSRSS_API_REPLY Reply)
   return Status;
 }
 
+NTSTATUS STDCALL
+CsrInsertObject(PVOID Object,
+                PACCESS_STATE PassedAccessState,
+                ACCESS_MASK DesiredAccess,
+                ULONG AdditionalReferences,
+                PVOID* ReferencedObject,
+                PHANDLE Handle)
+{
+  NTSTATUS Status;
+  PEPROCESS OldProcess;
+
+  /* Switch to the process in which the handle is valid */
+  OldProcess = PsGetCurrentProcess();
+  if (CsrProcess != OldProcess)
+    {
+      KeAttachProcess(CsrProcess);
+    }
+
+  Status = ObInsertObject(Object,
+                          PassedAccessState,
+                          DesiredAccess,
+                          AdditionalReferences,
+                          ReferencedObject,
+                          Handle);
+
+  if (CsrProcess != OldProcess)
+    {
+      KeDetachProcess();
+    }
+
+  return Status;
+}
+
+NTSTATUS FASTCALL
+CsrCloseHandle(HANDLE Handle)
+{
+  NTSTATUS Status;
+  PEPROCESS OldProcess;
+  
+  /* Switch to the process in which the handle is valid */
+  OldProcess = PsGetCurrentProcess();
+  if (CsrProcess != OldProcess)
+    {
+      KeAttachProcess(CsrProcess);
+    }
+
+  Status = ZwClose(Handle);
+
+  if (CsrProcess != OldProcess)
+    {
+      KeDetachProcess();
+    }
+
+  return Status;
+}
+
 /* EOF */
diff --git a/reactos/subsys/win32k/ntuser/desktop.c b/reactos/subsys/win32k/ntuser/desktop.c
index 975d46e624b..fb849980764 100644
--- a/reactos/subsys/win32k/ntuser/desktop.c
+++ b/reactos/subsys/win32k/ntuser/desktop.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- *  $Id: desktop.c,v 1.23 2004/11/06 22:28:11 gvg Exp $
+ *  $Id: desktop.c,v 1.24 2004/11/20 16:46:06 weiden Exp $
  *
  *  COPYRIGHT:        See COPYING in the top level directory
  *  PROJECT:          ReactOS kernel
@@ -66,6 +66,179 @@ CleanupDesktopImpl(VOID)
 
 /* PRIVATE FUNCTIONS **********************************************************/
 
+NTSTATUS FASTCALL
+IntParseDesktopPath(PEPROCESS Process,
+                    PUNICODE_STRING DesktopPath,
+                    HWINSTA *hWinSta,
+                    HDESK *hDesktop)
+{
+  OBJECT_ATTRIBUTES ObjectAttributes;
+  UNICODE_STRING WinSta, Desktop, FullName;
+  BOOL DesktopPresent = FALSE;
+  BOOL WinStaPresent = FALSE;
+  NTSTATUS Status;
+  
+  ASSERT(hWinSta);
+  
+  *hWinSta = NULL;
+  
+  if(hDesktop != NULL)
+  {
+    *hDesktop = NULL;
+  }
+  
+  RtlInitUnicodeString(&WinSta, NULL);
+  RtlInitUnicodeString(&Desktop, NULL);
+  
+  if(DesktopPath != NULL && DesktopPath->Buffer != NULL && DesktopPath->Length > sizeof(WCHAR))
+  {
+    PWCHAR c = DesktopPath->Buffer;
+    USHORT wl = 0;
+    USHORT l = DesktopPath->Length;
+
+    /*
+     * Parse the desktop path string which can be in the form "WinSta\Desktop"
+     * or just "Desktop". In latter case WinSta0 will be used.
+     */
+
+    while(l > 0)
+    {
+      if(*c == L'\\')
+      {
+        wl = (ULONG_PTR)c - (ULONG_PTR)DesktopPath->Buffer;
+        break;
+      }
+      l -= sizeof(WCHAR);
+      c++;
+    }
+    
+    if(wl > 0)
+    {
+      WinSta.Length = wl;
+      WinSta.MaximumLength = wl + sizeof(WCHAR);
+      WinSta.Buffer = DesktopPath->Buffer;
+      
+      WinStaPresent = TRUE;
+      c++;
+    }
+    
+    Desktop.Length = DesktopPath->Length - wl;
+    if(wl > 0)
+    {
+      Desktop.Length -= sizeof(WCHAR);
+    }
+    if(Desktop.Length > 0)
+    {
+      Desktop.MaximumLength = Desktop.Length + sizeof(WCHAR);
+      Desktop.Buffer = ((wl > 0) ? c : DesktopPath->Buffer);
+      DesktopPresent = TRUE;
+    }
+  }
+  
+  if(!WinStaPresent)
+  {
+    /* search the process handle table for (inherited) window station
+       handles, use a more appropriate one than WinSta0 if possible. */
+    Status = ObFindHandleForObject(Process,
+                                   NULL,
+                                   ExWindowStationObjectType,
+                                   NULL,
+                                   (PHANDLE)hWinSta);
+    if(!NT_SUCCESS(Status))
+    {
+      /* we had no luck searching for opened handles, use WinSta0 now */
+      RtlInitUnicodeString(&WinSta, L"WinSta0");
+    }
+  }
+  
+  if(!DesktopPresent && hDesktop != NULL)
+  {
+    /* search the process handle table for (inherited) desktop
+       handles, use a more appropriate one than Default if possible. */
+    Status = ObFindHandleForObject(Process,
+                                   NULL,
+                                   ExDesktopObjectType,
+                                   NULL,
+                                   (PHANDLE)hDesktop);
+    if(!NT_SUCCESS(Status))
+    {
+      /* we had no luck searching for opened handles, use Desktop now */
+      RtlInitUnicodeString(&Desktop, L"Default");
+    }
+  }
+  
+  if(*hWinSta == NULL)
+  {
+    if(!IntGetFullWindowStationName(&FullName, &WinSta, NULL))
+    {
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+
+    /* open the window station */
+    InitializeObjectAttributes(&ObjectAttributes,
+                               &FullName,
+                               OBJ_CASE_INSENSITIVE,
+                               NULL,
+                               NULL);
+
+    Status = ObOpenObjectByName(&ObjectAttributes,
+                                ExWindowStationObjectType,
+                                NULL,
+                                UserMode,
+                                0,
+                                NULL,
+                                (HANDLE*)hWinSta);
+
+    RtlFreeUnicodeString(&FullName);
+
+    if(!NT_SUCCESS(Status))
+    {
+      SetLastNtError(Status);
+      DPRINT("Failed to reference window station %wZ PID: %d!\n", &WinSta, PsGetCurrentProcessId());
+      return Status;
+    }
+  }
+  
+  if(hDesktop != NULL && *hDesktop == NULL)
+  {
+    if(!IntGetFullWindowStationName(&FullName, &WinSta, &Desktop))
+    {
+      NtClose(*hWinSta);
+      *hWinSta = NULL;
+      return STATUS_INSUFFICIENT_RESOURCES;
+    }
+    
+    /* open the desktop object */
+    InitializeObjectAttributes(&ObjectAttributes,
+                               &FullName,
+                               OBJ_CASE_INSENSITIVE,
+                               NULL,
+                               NULL);
+
+     Status = ObOpenObjectByName(&ObjectAttributes,
+                                 ExDesktopObjectType,
+                                 NULL,
+                                 UserMode,
+                                 0,
+                                 NULL,
+                                 (HANDLE*)hDesktop);
+
+    RtlFreeUnicodeString(&FullName);
+    
+    if(!NT_SUCCESS(Status))
+    {
+      *hDesktop = NULL;
+      NtClose(*hWinSta);
+      *hWinSta = NULL;
+      SetLastNtError(Status);
+      DPRINT("Failed to reference desktop %wZ PID: %d!\n", &Desktop, PsGetCurrentProcessId());
+      return Status;
+    }
+  }
+  
+  return STATUS_SUCCESS;
+}
+
 /*
  * IntValidateDesktopHandle
  *
@@ -322,17 +495,19 @@ NtUserCreateDesktop(
   HDESK Desktop;
   CSRSS_API_REQUEST Request;
   CSRSS_API_REPLY Reply;
+  
+  DPRINT1("CreateDesktop: %wZ\n", lpszDesktopName);
 
   Status = IntValidateWindowStationHandle(
     hWindowStation,
     KernelMode,
-    0,
+    0, /* FIXME - WINSTA_CREATEDESKTOP */
     &WinStaObject);
 
   if (! NT_SUCCESS(Status))
     {
-      DPRINT1("Failed validation of window station handle (0x%X)\n", 
-        hWindowStation);
+      DPRINT1("Failed validation of window station handle (0x%X), cannot create desktop %wZ\n",
+        hWindowStation, lpszDesktopName);
       SetLastNtError(Status);
       return NULL;
     }
@@ -428,14 +603,28 @@ NtUserCreateDesktop(
       return NULL;
     }
 
+  /*
+   * Create a handle for CSRSS and notify CSRSS
+   */
   Request.Type = CSRSS_CREATE_DESKTOP;
-  memcpy(Request.Data.CreateDesktopRequest.DesktopName, lpszDesktopName->Buffer,
-         lpszDesktopName->Length);
-  Request.Data.CreateDesktopRequest.DesktopName[lpszDesktopName->Length / sizeof(WCHAR)] = L'\0';
+  Status = CsrInsertObject((PVOID)DesktopObject,
+                           NULL,
+                           GENERIC_ALL,
+                           0,
+                           NULL,
+                           (HANDLE*)&Request.Data.CreateDesktopRequest.DesktopHandle);
+  if (! NT_SUCCESS(Status))
+  {
+    DPRINT1("Failed to create desktop handle for CSRSS\n");
+    ZwClose(Desktop);
+    SetLastNtError(Status);
+    return NULL;
+  }
 
   Status = CsrNotify(&Request, &Reply);
   if (! NT_SUCCESS(Status))
     {
+      CsrCloseHandle(Request.Data.CreateDesktopRequest.DesktopHandle);
       DPRINT1("Failed to notify CSRSS about new desktop\n");
       ZwClose(Desktop);
       SetLastNtError(Status);
@@ -485,15 +674,15 @@ NtUserOpenDesktop(
     */
 
    Status = IntValidateWindowStationHandle(
-      PROCESS_WINDOW_STATION(),
+      PsGetCurrentProcess()->Win32WindowStation,
       KernelMode,
       0,
       &WinStaObject);
 
    if (!NT_SUCCESS(Status))
    {
-      DPRINT("Failed validation of window station handle (0x%X)\n",
-         PROCESS_WINDOW_STATION());
+      DPRINT1("Failed validation of window station handle (0x%X)\n",
+              PsGetCurrentProcess()->Win32WindowStation);
       SetLastNtError(Status);
       return 0;
    }
@@ -508,7 +697,7 @@ NtUserOpenDesktop(
  
    ObDereferenceObject(WinStaObject);
 
-   DPRINT("Trying to open desktop station (%wZ)\n", &DesktopName);
+   DPRINT1("Trying to open desktop (%wZ)\n", &DesktopName);
 
    /* Initialize ObjectAttributes for the desktop object */
    InitializeObjectAttributes(
@@ -1026,13 +1215,6 @@ NtUserSetThreadDesktop(HDESK hDesktop)
    }
 
    W32Thread = PsGetWin32Thread();
-   /* Check for setting the same desktop as before. */
-   if (DesktopObject == W32Thread->Desktop)
-   {
-      W32Thread->hDesktop = hDesktop;
-      ObDereferenceObject(DesktopObject);
-      return TRUE;
-   }
 
    /* FIXME: Should check here to see if the thread has any windows. */
 
diff --git a/reactos/subsys/win32k/ntuser/hook.c b/reactos/subsys/win32k/ntuser/hook.c
index ca25f6aafd9..09541394891 100644
--- a/reactos/subsys/win32k/ntuser/hook.c
+++ b/reactos/subsys/win32k/ntuser/hook.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: hook.c,v 1.9 2004/09/28 15:02:30 weiden Exp $
+/* $Id: hook.c,v 1.10 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -289,7 +289,7 @@ HOOK_CallHooks(INT HookId, INT Code, WPARAM wParam, LPARAM lParam)
   Result = IntCallHookProc(HookId, Code, wParam, lParam, Hook->Proc,
                            Hook->Ansi, &Hook->ModuleName);
 
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
 				          KernelMode,
 				          0,
 				          &WinStaObj);
@@ -319,11 +319,11 @@ HOOK_DestroyThreadHooks(PETHREAD Thread)
 
   if (NULL != GlobalHooks)
     {
-      Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+      Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
                                               KernelMode,
                                               0,
                                               &WinStaObj);
-  
+
       if(! NT_SUCCESS(Status))
         {
           DPRINT1("Invalid window station????\n");
@@ -367,11 +367,11 @@ NtUserCallNextHookEx(
   PWINSTATION_OBJECT WinStaObj;
   NTSTATUS Status;
 
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
 				          KernelMode,
 				          0,
 				          &WinStaObj);
-  
+
   if(! NT_SUCCESS(Status))
     {
       SetLastNtError(Status);
@@ -509,7 +509,7 @@ NtUserSetWindowsHookEx(
       return NULL;
     }
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
 				          KernelMode,
 				          0,
 				          &WinStaObj);
@@ -613,7 +613,7 @@ NtUserUnhookWindowsHookEx(
   PHOOK HookObj;
   NTSTATUS Status;
 
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
 				          KernelMode,
 				          0,
 				          &WinStaObj);
diff --git a/reactos/subsys/win32k/ntuser/hotkey.c b/reactos/subsys/win32k/ntuser/hotkey.c
index f50f2c2dd02..8022edd5f6d 100644
--- a/reactos/subsys/win32k/ntuser/hotkey.c
+++ b/reactos/subsys/win32k/ntuser/hotkey.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: hotkey.c,v 1.10 2004/05/25 15:52:44 navaraf Exp $
+/* $Id: hotkey.c,v 1.11 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -114,9 +114,8 @@ UnregisterWindowHotKeys(PWINDOW_OBJECT Window)
   PHOT_KEY_ITEM HotKeyItem;
   PWINSTATION_OBJECT WinStaObject = NULL;
   
-  if(Window->OwnerThread && Window->OwnerThread->ThreadsProcess &&
-     Window->OwnerThread->ThreadsProcess->Win32Process)
-    WinStaObject = Window->OwnerThread->ThreadsProcess->Win32Process->WindowStation;
+  if(Window->OwnerThread && Window->OwnerThread->ThreadsProcess)
+    WinStaObject = Window->OwnerThread->Tcb.Win32Thread->Desktop->WindowStation;
 
   if(!WinStaObject)
     return;
@@ -148,8 +147,8 @@ UnregisterThreadHotKeys(struct _ETHREAD *Thread)
   PHOT_KEY_ITEM HotKeyItem;
   PWINSTATION_OBJECT WinStaObject = NULL;
   
-  if(Thread->ThreadsProcess && Thread->ThreadsProcess->Win32Process)
-    WinStaObject = Thread->ThreadsProcess->Win32Process->WindowStation;
+  if(Thread->Tcb.Win32Thread && Thread->Tcb.Win32Thread->Desktop)
+    WinStaObject = Thread->Tcb.Win32Thread->Desktop->WindowStation;
   
   if(!WinStaObject)
     return;
@@ -230,7 +229,7 @@ NtUserRegisterHotKey(HWND hWnd,
 
   
   if(HotKeyThread->ThreadsProcess && HotKeyThread->ThreadsProcess->Win32Process)
-    WinStaObject = HotKeyThread->ThreadsProcess->Win32Process->WindowStation;
+    WinStaObject = HotKeyThread->Tcb.Win32Thread->Desktop->WindowStation;
   
   if(!WinStaObject)
   {
@@ -285,7 +284,7 @@ NtUserUnregisterHotKey(HWND hWnd,
   }
   
   if(Window->OwnerThread->ThreadsProcess && Window->OwnerThread->ThreadsProcess->Win32Process)
-    WinStaObject = Window->OwnerThread->ThreadsProcess->Win32Process->WindowStation;
+    WinStaObject = Window->OwnerThread->Tcb.Win32Thread->Desktop->WindowStation;
   
   if(!WinStaObject)
   {
diff --git a/reactos/subsys/win32k/ntuser/menu.c b/reactos/subsys/win32k/ntuser/menu.c
index 156c59d9fa3..0a96dd091bb 100644
--- a/reactos/subsys/win32k/ntuser/menu.c
+++ b/reactos/subsys/win32k/ntuser/menu.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: menu.c,v 1.55 2004/05/13 20:21:27 navaraf Exp $
+/* $Id: menu.c,v 1.56 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -135,16 +135,15 @@ PMENU_OBJECT FASTCALL
 IntGetMenuObject(HMENU hMenu)
 {
   PMENU_OBJECT MenuObject;
-  PW32PROCESS W32Process = PsGetWin32Process();
+  PW32THREAD W32Thread = PsGetWin32Thread();
   
-  if(!W32Process)
+  if(!W32Thread)
   {
     return NULL;
   }
   
-  NTSTATUS Status = ObmReferenceObjectByHandle(W32Process->
-                      WindowStation->HandleTable, hMenu, otMenu, 
-                      (PVOID*)&MenuObject);
+  NTSTATUS Status = ObmReferenceObjectByHandle(W32Thread->Desktop->WindowStation->HandleTable,
+                                               hMenu, otMenu, (PVOID*)&MenuObject);
   if (!NT_SUCCESS(Status))
   {
     return NULL;
@@ -225,6 +224,9 @@ IntDestroyMenuObject(PMENU_OBJECT MenuObject,
 {
   if(MenuObject)
   {
+    PWINSTATION_OBJECT WindowStation;
+    NTSTATUS Status;
+    
     /* remove all menu items */
     IntLockMenuItems(MenuObject);
     IntDeleteMenuItems(MenuObject, bRecurse); /* do not destroy submenus */
@@ -232,14 +234,23 @@ IntDestroyMenuObject(PMENU_OBJECT MenuObject,
     
     if(RemoveFromProcess)
     {
-      IntLockProcessMenus(MenuObject->W32Process);
+      IntLockProcessMenus(MenuObject->Process->Win32Process);
       RemoveEntryList(&MenuObject->ListEntry);
-      IntUnLockProcessMenus(MenuObject->W32Process);
+      IntUnLockProcessMenus(MenuObject->Process->Win32Process);
     }
     
-    ObmCloseHandle(MenuObject->W32Process->WindowStation->HandleTable, MenuObject->MenuInfo.Self);
-  
-    return TRUE;
+    Status = ObReferenceObjectByHandle(MenuObject->Process->Win32WindowStation,
+                                       0,
+                                       ExWindowStationObjectType,
+                                       KernelMode,
+                                       (PVOID*)&WindowStation,
+                                       NULL);
+    if(NT_SUCCESS(Status))
+    {
+      ObmCloseHandle(WindowStation->HandleTable, MenuObject->MenuInfo.Self);
+      ObDereferenceObject(WindowStation);
+      return TRUE;
+    }
   }
   return FALSE;
 }
@@ -248,10 +259,10 @@ PMENU_OBJECT FASTCALL
 IntCreateMenu(PHANDLE Handle, BOOL IsMenuBar)
 {
   PMENU_OBJECT MenuObject;
-  PW32PROCESS Win32Process = PsGetWin32Process();
+  PW32THREAD Win32Thread = PsGetWin32Thread();
 
   MenuObject = (PMENU_OBJECT)ObmCreateObject(
-      Win32Process->WindowStation->HandleTable, Handle, 
+      Win32Thread->Desktop->WindowStation->HandleTable, Handle,
       otMenu, sizeof(MENU_OBJECT));
 
   if(!MenuObject)
@@ -260,7 +271,7 @@ IntCreateMenu(PHANDLE Handle, BOOL IsMenuBar)
     return NULL;
   }
   
-  MenuObject->W32Process = Win32Process;
+  MenuObject->Process = PsGetCurrentProcess();
   MenuObject->RtoL = FALSE; /* default */
   MenuObject->MenuInfo.cbSize = sizeof(MENUINFO); /* not used */
   MenuObject->MenuInfo.fMask = 0; /* not used */
@@ -284,9 +295,9 @@ IntCreateMenu(PHANDLE Handle, BOOL IsMenuBar)
   ExInitializeFastMutex(&MenuObject->MenuItemsLock);
 
   /* Insert menu item into process menu handle list */
-  IntLockProcessMenus(Win32Process);
-  InsertTailList(&Win32Process->MenuListHead, &MenuObject->ListEntry);
-  IntUnLockProcessMenus(Win32Process);
+  IntLockProcessMenus(PsGetWin32Process());
+  InsertTailList(&PsGetWin32Process()->MenuListHead, &MenuObject->ListEntry);
+  IntUnLockProcessMenus(PsGetWin32Process());
 
   return MenuObject;
 }
@@ -363,18 +374,17 @@ IntCloneMenu(PMENU_OBJECT Source)
 {
   HANDLE Handle;
   PMENU_OBJECT MenuObject;
-  PW32PROCESS Process = PsGetWin32Process();
   
   if(!Source)
     return NULL;
     
   MenuObject = (PMENU_OBJECT)ObmCreateObject(
-    Process->WindowStation->HandleTable, &Handle, 
+    PsGetWin32Thread()->Desktop->WindowStation->HandleTable, &Handle,
     otMenu, sizeof(MENU_OBJECT));  
   if(!MenuObject)
     return NULL;
   
-  MenuObject->W32Process = Process;
+  MenuObject->Process = PsGetCurrentProcess();
   MenuObject->RtoL = Source->RtoL;
   MenuObject->MenuInfo.cbSize = sizeof(MENUINFO); /* not used */
   MenuObject->MenuInfo.fMask = Source->MenuInfo.fMask;
@@ -396,9 +406,9 @@ IntCloneMenu(PMENU_OBJECT Source)
   ExInitializeFastMutex(&MenuObject->MenuItemsLock);
   
   /* Insert menu item into process menu handle list */
-  IntLockProcessMenus(Process);
-  InsertTailList(&Process->MenuListHead, &MenuObject->ListEntry);
-  IntUnLockProcessMenus(Process);
+  IntLockProcessMenus(PsGetWin32Process());
+  InsertTailList(&PsGetWin32Process()->MenuListHead, &MenuObject->ListEntry);
+  IntUnLockProcessMenus(PsGetWin32Process());
 
   IntCloneMenuItems(MenuObject, Source);
 
@@ -1328,7 +1338,7 @@ NtUserCreateMenu(BOOL PopupMenu)
   PWINSTATION_OBJECT WinStaObject;
   HANDLE Handle;
 
-  NTSTATUS Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  NTSTATUS Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
 				       KernelMode,
 				       0,
 				       &WinStaObject);
@@ -1387,7 +1397,7 @@ NtUserDestroyMenu(
     SetLastWin32Error(ERROR_INVALID_MENU_HANDLE);
     return FALSE;
   }
-  if(MenuObject->W32Process != PsGetWin32Process())
+  if(MenuObject->Process != PsGetCurrentProcess())
   {
     IntReleaseMenuObject(MenuObject);
     SetLastWin32Error(ERROR_ACCESS_DENIED);
diff --git a/reactos/subsys/win32k/ntuser/message.c b/reactos/subsys/win32k/ntuser/message.c
index 12faf6c808c..725dba03518 100644
--- a/reactos/subsys/win32k/ntuser/message.c
+++ b/reactos/subsys/win32k/ntuser/message.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: message.c,v 1.74 2004/09/28 15:02:30 weiden Exp $
+/* $Id: message.c,v 1.75 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -1126,7 +1126,7 @@ NtUserPostMessage(HWND Wnd,
           SetLastWin32Error(ERROR_INVALID_PARAMETER);
           return FALSE;
         }
-      CurInfo = IntGetSysCursorInfo(PsGetWin32Process()->WindowStation);
+      CurInfo = IntGetSysCursorInfo(PsGetWin32Thread()->Desktop->WindowStation);
       KernelModeMsg.pt.x = CurInfo->x;
       KernelModeMsg.pt.y = CurInfo->y;
       KeQueryTickCount(&LargeTickCount);
diff --git a/reactos/subsys/win32k/ntuser/metric.c b/reactos/subsys/win32k/ntuser/metric.c
index abfa13ee46e..17f5d614c8e 100644
--- a/reactos/subsys/win32k/ntuser/metric.c
+++ b/reactos/subsys/win32k/ntuser/metric.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: metric.c,v 1.22 2004/10/04 19:23:31 jc Exp $
+/* $Id: metric.c,v 1.23 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -68,7 +68,7 @@ NtUserGetSystemMetrics(ULONG Index)
     case SM_SWAPBUTTON:
     {
       PSYSTEM_CURSORINFO CurInfo;
-      Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+      Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
                                               KernelMode,
                                               0,
                                               &WinStaObject);
diff --git a/reactos/subsys/win32k/ntuser/misc.c b/reactos/subsys/win32k/ntuser/misc.c
index 9b8b54c97c3..006194d0835 100644
--- a/reactos/subsys/win32k/ntuser/misc.c
+++ b/reactos/subsys/win32k/ntuser/misc.c
@@ -1,4 +1,4 @@
-/* $Id: misc.c,v 1.87 2004/10/19 08:25:25 gvg Exp $
+/* $Id: misc.c,v 1.88 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -215,7 +215,7 @@ NtUserCallOneParam(
       NTSTATUS Status;
       DWORD Result;
       
-      Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+      Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
                                               KernelMode,
                                               0,
                                               &WinStaObject);
@@ -265,7 +265,7 @@ NtUserCallOneParam(
       
       if(!Param)
         return (DWORD)FALSE;
-      Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+      Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
                                               KernelMode,
                                               0,
                                               &WinStaObject);
@@ -686,7 +686,7 @@ IntSystemParametersInfo(
     {
       PSYSTEM_CURSORINFO CurInfo;
       
-      Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+      Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
                                               KernelMode,
                                               0,
                                               &WinStaObject);
@@ -1038,7 +1038,7 @@ NtUserGetDoubleClickTime(VOID)
   PWINSTATION_OBJECT WinStaObject;
   PSYSTEM_CURSORINFO CurInfo;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
                                           KernelMode,
                                           0,
                                           &WinStaObject);
diff --git a/reactos/subsys/win32k/ntuser/monitor.c b/reactos/subsys/win32k/ntuser/monitor.c
index a7b4104c10e..a413fef4f16 100644
--- a/reactos/subsys/win32k/ntuser/monitor.c
+++ b/reactos/subsys/win32k/ntuser/monitor.c
@@ -91,7 +91,7 @@ IntCreateMonitorObject()
   HANDLE Handle;
   PMONITOR_OBJECT Monitor;
 
-  Monitor = ObmCreateObject(PsGetWin32Process()->WindowStation->HandleTable, &Handle, otMonitor, sizeof (MONITOR_OBJECT));
+  Monitor = ObmCreateObject(PsGetWin32Thread()->Desktop->WindowStation->HandleTable, &Handle, otMonitor, sizeof (MONITOR_OBJECT));
   if (Monitor == NULL)
     {
       return NULL;
@@ -141,7 +141,7 @@ IntGetMonitorObject(IN HMONITOR hMonitor)
   PMONITOR_OBJECT Monitor;
   NTSTATUS Status;
 
-  Status = ObmReferenceObjectByHandle(PsGetWin32Process()->WindowStation->HandleTable, hMonitor, otMonitor, (PVOID *)&Monitor);
+  Status = ObmReferenceObjectByHandle(PsGetWin32Thread()->Desktop->WindowStation->HandleTable, hMonitor, otMonitor, (PVOID *)&Monitor);
   if (!NT_SUCCESS(Status) || Monitor == NULL)
     {
       /* FIXME: SetLastNtError( status ); ? */
diff --git a/reactos/subsys/win32k/ntuser/msgqueue.c b/reactos/subsys/win32k/ntuser/msgqueue.c
index 241b234ec93..433c78d908b 100644
--- a/reactos/subsys/win32k/ntuser/msgqueue.c
+++ b/reactos/subsys/win32k/ntuser/msgqueue.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: msgqueue.c,v 1.107 2004/09/28 15:02:30 weiden Exp $
+/* $Id: msgqueue.c,v 1.108 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -175,18 +175,15 @@ MsqIsDblClk(LPMSG Msg, BOOL Remove)
 {
   PWINSTATION_OBJECT WinStaObject;
   PSYSTEM_CURSORINFO CurInfo;
-  NTSTATUS Status;
   LONG dX, dY;
   BOOL Res;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-                                          KernelMode,
-                                          0,
-                                          &WinStaObject);
-  if (!NT_SUCCESS(Status))
+  if (PsGetWin32Thread()->Desktop == NULL)
   {
     return FALSE;
   }
+  WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
+  
   CurInfo = IntGetSysCursorInfo(WinStaObject);
   Res = (Msg->hwnd == (HWND)CurInfo->LastClkWnd) && 
         ((Msg->time - CurInfo->LastBtnDown) < CurInfo->DblClickSpeed);
@@ -220,7 +217,6 @@ MsqIsDblClk(LPMSG Msg, BOOL Remove)
     }
   }
   
-  ObDereferenceObject(WinStaObject);
   return Res;
 }
 
@@ -616,7 +612,7 @@ MsqPostHotKeyMessage(PVOID Thread, HWND hWnd, WPARAM wParam, LPARAM lParam)
 {
   PWINDOW_OBJECT Window;
   PW32THREAD Win32Thread;
-  PW32PROCESS Win32Process;
+  PWINSTATION_OBJECT WinSta;
   MSG Mesg;
   NTSTATUS Status;
 
@@ -634,14 +630,8 @@ MsqPostHotKeyMessage(PVOID Thread, HWND hWnd, WPARAM wParam, LPARAM lParam)
       return;
     }
 
-  Win32Process = ((PETHREAD)Thread)->ThreadsProcess->Win32Process;
-  if (Win32Process == NULL || Win32Process->WindowStation == NULL)
-    {
-      ObDereferenceObject ((PETHREAD)Thread);
-      return;
-    }
-
-  Status = ObmReferenceObjectByHandle(Win32Process->WindowStation->HandleTable,
+  WinSta = Win32Thread->Desktop->WindowStation;
+  Status = ObmReferenceObjectByHandle(WinSta->HandleTable,
                                       hWnd, otWindow, (PVOID*)&Window);
   if (!NT_SUCCESS(Status))
     {
diff --git a/reactos/subsys/win32k/ntuser/useratom.c b/reactos/subsys/win32k/ntuser/useratom.c
index d595e10f119..e67ec1535ba 100644
--- a/reactos/subsys/win32k/ntuser/useratom.c
+++ b/reactos/subsys/win32k/ntuser/useratom.c
@@ -35,17 +35,15 @@ IntAddAtom(LPWSTR AtomName)
    PWINSTATION_OBJECT WinStaObject;
    NTSTATUS Status;
    RTL_ATOM Atom;
-
-   Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-      KernelMode, 0, &WinStaObject);
-   if (!NT_SUCCESS(Status))
+   
+   if (PsGetWin32Thread()->Desktop == NULL)
    {
       SetLastNtError(Status);      
       return (RTL_ATOM)0;
    }
+   WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
    Status = RtlAddAtomToAtomTable(WinStaObject->AtomTable,
       AtomName, &Atom);
-   ObDereferenceObject(WinStaObject);
    if (!NT_SUCCESS(Status))
    {
       SetLastNtError(Status);      
@@ -61,18 +59,16 @@ IntGetAtomName(RTL_ATOM nAtom, LPWSTR lpBuffer, ULONG nSize)
    NTSTATUS Status;
    ULONG Size = nSize;
 
-   Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-      KernelMode, 0, &WinStaObject);
-   if (!NT_SUCCESS(Status))
+   if (PsGetWin32Thread()->Desktop == NULL)
    {
       SetLastNtError(Status);      
       return 0;
    }
+   WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
    Status = RtlQueryAtomInAtomTable(WinStaObject->AtomTable,
       nAtom, NULL, NULL, lpBuffer, &Size);
    if (Size < nSize)
       *(lpBuffer + Size) = 0;
-   ObDereferenceObject(WinStaObject);
    if (!NT_SUCCESS(Status))
    {
       SetLastNtError(Status);      
diff --git a/reactos/subsys/win32k/ntuser/window.c b/reactos/subsys/win32k/ntuser/window.c
index f0e99f47345..f2cab54c149 100644
--- a/reactos/subsys/win32k/ntuser/window.c
+++ b/reactos/subsys/win32k/ntuser/window.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: window.c,v 1.248 2004/11/15 23:10:42 gvg Exp $
+/* $Id: window.c,v 1.249 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -106,18 +106,21 @@ IntIsWindow(HWND hWnd)
  */
 
 PWINDOW_OBJECT FASTCALL
-IntGetProcessWindowObject(PW32PROCESS ProcessData, HWND hWnd)
+IntGetProcessWindowObject(PW32THREAD Thread, HWND hWnd)
 {
    PWINDOW_OBJECT WindowObject;
    NTSTATUS Status;
-
-   Status = ObmReferenceObjectByHandle(ProcessData->WindowStation->HandleTable,
-      hWnd, otWindow, (PVOID*)&WindowObject);
-   if (!NT_SUCCESS(Status))
+   
+   if(Thread->Desktop != NULL)
    {
-      return NULL;
+     Status = ObmReferenceObjectByHandle(Thread->Desktop->WindowStation->HandleTable,
+                                         hWnd, otWindow, (PVOID*)&WindowObject);
+     if (NT_SUCCESS(Status))
+     {
+        return WindowObject;
+     }
    }
-   return WindowObject;
+   return NULL;
 }
 
 
@@ -328,13 +331,13 @@ static LRESULT IntDestroyWindow(PWINDOW_OBJECT Window,
     }
 
   /* reset shell window handles */
-  if(ProcessData->WindowStation)
+  if(ThreadData->Desktop)
   {
-    if (Window->Self == ProcessData->WindowStation->ShellWindow)
-      ProcessData->WindowStation->ShellWindow = NULL;
+    if (Window->Self == ThreadData->Desktop->WindowStation->ShellWindow)
+      ThreadData->Desktop->WindowStation->ShellWindow = NULL;
 
-    if (Window->Self == ProcessData->WindowStation->ShellListView)
-      ProcessData->WindowStation->ShellListView = NULL;
+    if (Window->Self == ThreadData->Desktop->WindowStation->ShellListView)
+      ThreadData->Desktop->WindowStation->ShellListView = NULL;
   }
   
   /* Unregister hot keys */
@@ -378,7 +381,7 @@ static LRESULT IntDestroyWindow(PWINDOW_OBJECT Window,
   IntUnlinkWindow(Window);
   
   IntReferenceWindowObject(Window);
-  ObmCloseHandle(ProcessData->WindowStation->HandleTable, Window->Self);
+  ObmCloseHandle(ThreadData->Desktop->WindowStation->HandleTable, Window->Self);
   
   IntDestroyScrollBars(Window);
   
@@ -613,15 +616,15 @@ PMENU_OBJECT FASTCALL
 IntGetSystemMenu(PWINDOW_OBJECT WindowObject, BOOL bRevert, BOOL RetMenu)
 {
   PMENU_OBJECT MenuObject, NewMenuObject, SysMenuObject, ret = NULL;
-  PW32PROCESS W32Process;
+  PW32THREAD W32Thread;
   HMENU NewMenu, SysMenu;
   ROSMENUITEMINFO ItemInfo;
 
   if(bRevert)
   {
-    W32Process = PsGetWin32Process();
+    W32Thread = PsGetWin32Thread();
     
-    if(!W32Process->WindowStation)
+    if(!W32Thread->Desktop)
       return NULL;
       
     if(WindowObject->SystemMenu)
@@ -635,10 +638,10 @@ IntGetSystemMenu(PWINDOW_OBJECT WindowObject, BOOL bRevert, BOOL RetMenu)
       }
     }
       
-    if(W32Process->WindowStation->SystemMenuTemplate)
+    if(W32Thread->Desktop->WindowStation->SystemMenuTemplate)
     {
       /* clone system menu */
-      MenuObject = IntGetMenuObject(W32Process->WindowStation->SystemMenuTemplate);
+      MenuObject = IntGetMenuObject(W32Thread->Desktop->WindowStation->SystemMenuTemplate);
       if(!MenuObject)
         return NULL;
 
@@ -1415,7 +1418,7 @@ IntCreateWindowEx(DWORD dwExStyle,
   BOOL MenuChanged;
   BOOL ClassFound;
   PWSTR ClassNameString;
-  
+  DPRINT1("PsGetWin32Thread()->Desktop == 0x%x\n", PsGetWin32Thread()->Desktop);
   ParentWindowHandle = PsGetWin32Thread()->Desktop->DesktopWindow;
   OwnerWindowHandle = NULL;
 
@@ -1487,27 +1490,22 @@ IntCreateWindowEx(DWORD dwExStyle,
   }
 
   /* Check the window station. */
-  DPRINT("IoGetCurrentProcess() %X\n", IoGetCurrentProcess());
-  DPRINT("PROCESS_WINDOW_STATION %X\n", PROCESS_WINDOW_STATION());
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-					  KernelMode,
-					  0,
-					  &WinStaObject);
-  if (!NT_SUCCESS(Status))
+  if (PsGetWin32Thread()->Desktop == NULL)
     {
       ClassDereferenceObject(ClassObject);
       if (NULL != ParentWindow)
         {
           IntReleaseWindowObject(ParentWindow);
         }
-      DPRINT("Validation of window station handle (0x%X) failed\n",
-	     PROCESS_WINDOW_STATION());
+      DPRINT("Thread is not attached to a desktop! Cannot create window!\n");
       return (HWND)0;
     }
+  WinStaObject = PsGetWin32Thread()->Desktop->WindowStation;
+  ObReferenceObjectByPointer(WinStaObject, KernelMode, ExWindowStationObjectType, 0);
 
   /* Create the window object. */
   WindowObject = (PWINDOW_OBJECT)
-    ObmCreateObject(PsGetWin32Process()->WindowStation->HandleTable, &Handle,
+    ObmCreateObject(PsGetWin32Thread()->Desktop->WindowStation->HandleTable, &Handle,
         otWindow, sizeof(WINDOW_OBJECT) + ClassObject->cbWndExtra
         );
 
@@ -2872,7 +2870,7 @@ NtUserGetShellWindow()
   PWINSTATION_OBJECT WinStaObject;
   HWND Ret;
 
-  NTSTATUS Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  NTSTATUS Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
 				       KernelMode,
 				       0,
 				       &WinStaObject);
@@ -2904,7 +2902,7 @@ NtUserSetShellWindowEx(HWND hwndShell, HWND hwndListView)
 {
   PWINSTATION_OBJECT WinStaObject;
 
-  NTSTATUS Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
+  NTSTATUS Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
 				       KernelMode,
 				       0,
 				       &WinStaObject);
@@ -3255,7 +3253,6 @@ LONG STDCALL
 NtUserSetWindowLong(HWND hWnd, DWORD Index, LONG NewValue, BOOL Ansi)
 {
    PWINDOW_OBJECT WindowObject, Parent;
-   PW32PROCESS Process;
    PWINSTATION_OBJECT WindowStation;
    LONG OldValue;
    STYLESTRUCT Style;
@@ -3296,8 +3293,7 @@ NtUserSetWindowLong(HWND hWnd, DWORD Index, LONG NewValue, BOOL Ansi)
             /*
              * Remove extended window style bit WS_EX_TOPMOST for shell windows.
              */
-            Process = WindowObject->OwnerThread->ThreadsProcess->Win32Process;
-            WindowStation = Process->WindowStation;
+            WindowStation = WindowObject->OwnerThread->Tcb.Win32Thread->Desktop->WindowStation;
             if(WindowStation)
             {
               if (hWnd == WindowStation->ShellWindow || hWnd == WindowStation->ShellListView)
diff --git a/reactos/subsys/win32k/ntuser/winpos.c b/reactos/subsys/win32k/ntuser/winpos.c
index d3a68abafd9..90e833cce7b 100644
--- a/reactos/subsys/win32k/ntuser/winpos.c
+++ b/reactos/subsys/win32k/ntuser/winpos.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: winpos.c,v 1.122 2004/11/15 23:10:42 gvg Exp $
+/* $Id: winpos.c,v 1.123 2004/11/20 16:46:06 weiden Exp $
  *
  * COPYRIGHT:        See COPYING in the top level directory
  * PROJECT:          ReactOS kernel
@@ -1193,7 +1193,7 @@ WinPosShowWindow(HWND Wnd, INT Cmd)
 //  HRGN VisibleRgn;
 
   Status = 
-    ObmReferenceObjectByHandle(PsGetWin32Process()->WindowStation->HandleTable,
+    ObmReferenceObjectByHandle(PsGetWin32Thread()->Desktop->WindowStation->HandleTable,
 			       Wnd,
 			       otWindow,
 			       (PVOID*)&Window);
diff --git a/reactos/subsys/win32k/ntuser/winsta.c b/reactos/subsys/win32k/ntuser/winsta.c
index 35d41554e8b..2434c87a2ce 100644
--- a/reactos/subsys/win32k/ntuser/winsta.c
+++ b/reactos/subsys/win32k/ntuser/winsta.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  *
- *  $Id: winsta.c,v 1.65 2004/08/20 22:38:49 gvg Exp $
+ *  $Id: winsta.c,v 1.66 2004/11/20 16:46:06 weiden Exp $
  *
  *  COPYRIGHT:        See COPYING in the top level directory
  *  PROJECT:          ReactOS kernel
@@ -85,7 +85,7 @@ CleanupWindowStationImpl(VOID)
 /*
  * IntGetFullWindowStationName
  *
- * Get a full desktop object name from a name specified in 
+ * Get a full window station object name from a name specified in
  * NtUserCreateWindowStation, NtUserOpenWindowStation, NtUserCreateDesktop
  * or NtUserOpenDesktop.
  *
@@ -478,7 +478,7 @@ NtUserOpenWindowStation(
 
    Status = ObOpenObjectByName(
       &ObjectAttributes,
-      ExDesktopObjectType,
+      ExWindowStationObjectType,
       NULL,
       UserMode,
       dwDesiredAccess,
@@ -783,7 +783,48 @@ NtUserSetObjectInformation(
 HWINSTA STDCALL
 NtUserGetProcessWindowStation(VOID)
 {
-   return PROCESS_WINDOW_STATION();
+   if(PsGetCurrentProcess() != CsrProcess)
+   {
+     return PsGetCurrentProcess()->Win32WindowStation;
+   }
+   else
+   {
+     /* FIXME - get the pointer to the window station by querying the parent of
+                the desktop of the calling thread (which is a window station),
+                then use ObFindHandleForObject() to find a suitable handle */
+     DPRINT1("CSRSS called NtUserGetProcessWindowStation()!!! returned NULL!\n");
+     return NULL;
+   }
+}
+
+PWINSTATION_OBJECT FASTCALL
+IntGetWinStaObj(VOID)
+{
+  PWINSTATION_OBJECT WinStaObj;
+  
+  /*
+   * just a temporary hack, this will be gone soon
+   */
+  
+  if(PsGetWin32Thread()->Desktop != NULL)
+  {
+    WinStaObj = PsGetWin32Thread()->Desktop->WindowStation;
+    ObReferenceObjectByPointer(WinStaObj, KernelMode, ExWindowStationObjectType, 0);
+  }
+  else if(PsGetCurrentProcess() != CsrProcess)
+  {
+    NTSTATUS Status = IntValidateWindowStationHandle(PsGetCurrentProcess()->Win32WindowStation,
+                                                     KernelMode,
+                                                     0,
+                                                     &WinStaObj);
+   if(!NT_SUCCESS(Status))
+   {
+     SetLastNtError(Status);
+     return NULL;
+   }
+  }
+  
+  return WinStaObj;
 }
 
 /*
@@ -805,42 +846,43 @@ NtUserGetProcessWindowStation(VOID)
 BOOL STDCALL
 NtUserSetProcessWindowStation(HWINSTA hWindowStation)
 {
-   PWINSTATION_OBJECT Object;
-   PW32PROCESS Win32Process;
+   HANDLE hOld;
+   PWINSTATION_OBJECT NewWinSta;
    NTSTATUS Status;
 
-   DPRINT("About to set process window station with handle (0x%X)\n", 
+   DPRINT("About to set process window station with handle (0x%X)\n",
       hWindowStation);
 
+   if(PsGetCurrentProcess() == CsrProcess)
+   {
+     DPRINT1("CSRSS is not allowed to change it's window station!!!\n");
+     SetLastWin32Error(ERROR_ACCESS_DENIED);
+     return FALSE;
+   }
+
    Status = IntValidateWindowStationHandle(
       hWindowStation,
       KernelMode,
       0,
-      &Object);
+      &NewWinSta);
 
    if (!NT_SUCCESS(Status)) 
    {
       DPRINT("Validation of window station handle (0x%X) failed\n", 
          hWindowStation);
+      SetLastNtError(Status);
       return FALSE;
    }
+   
+   /*
+    * FIXME - don't allow changing the window station if there are threads that are attached to desktops and own gui objects
+    */
 
-   Win32Process = PsGetWin32Process();
-   if (Win32Process == NULL)
-   {
-      ObDereferenceObject(Object);
-   }
-   else
-   {
-      if (Win32Process->WindowStation != NULL)
-         ObDereferenceObject(Win32Process->WindowStation);
-      Win32Process->WindowStation = Object;
-   }
+   /* FIXME - dereference the old window station, etc... */
+   hOld = InterlockedExchangePointer(&PsGetCurrentProcess()->Win32WindowStation, hWindowStation);
 
-   SET_PROCESS_WINDOW_STATION(hWindowStation);
-  
-   DPRINT("IoGetCurrentProcess()->Win32WindowStation 0x%X\n",
-      IoGetCurrentProcess()->Win32WindowStation);
+   DPRINT("PsGetCurrentProcess()->Win32WindowStation 0x%X\n",
+      PsGetCurrentProcess()->Win32WindowStation);
 
    return TRUE;
 }
diff --git a/reactos/subsys/win32k/objects/cursoricon.c b/reactos/subsys/win32k/objects/cursoricon.c
index 800dbab9072..3291166b846 100644
--- a/reactos/subsys/win32k/objects/cursoricon.c
+++ b/reactos/subsys/win32k/objects/cursoricon.c
@@ -16,7 +16,7 @@
  *  along with this program; if not, write to the Free Software
  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
-/* $Id: cursoricon.c,v 1.64 2004/08/07 00:25:10 navaraf Exp $ */
+/* $Id: cursoricon.c,v 1.65 2004/11/20 16:46:06 weiden Exp $ */
 #include <w32k.h>
 
 PCURICON_OBJECT FASTCALL
@@ -371,20 +371,20 @@ IntCleanupCurIcons(struct _EPROCESS *Process, PW32PROCESS Win32Process)
   PCURICON_OBJECT Current;
   PLIST_ENTRY CurrentEntry, NextEntry;
   
-  if(!(WinStaObject = Win32Process->WindowStation))
-    return;
-  
-  IntLockProcessCursorIcons(Win32Process);
-  CurrentEntry = Win32Process->CursorIconListHead.Flink;
-  while(CurrentEntry != &Win32Process->CursorIconListHead)
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject != NULL)
   {
-    NextEntry = CurrentEntry->Flink;
-    Current = CONTAINING_RECORD(CurrentEntry, CURICON_OBJECT, ListEntry);
-    RemoveEntryList(&Current->ListEntry);
-    IntDestroyCurIconObject(WinStaObject, Current->Self, FALSE);
-    CurrentEntry = NextEntry;
+    CurrentEntry = Win32Process->CursorIconListHead.Flink;
+    while(CurrentEntry != &Win32Process->CursorIconListHead)
+    {
+      NextEntry = CurrentEntry->Flink;
+      Current = CONTAINING_RECORD(CurrentEntry, CURICON_OBJECT, ListEntry);
+      RemoveEntryList(&Current->ListEntry);
+      IntDestroyCurIconObject(WinStaObject, Current->Self, FALSE);
+      CurrentEntry = NextEntry;
+    }
+    ObDereferenceObject(WinStaObject);
   }
-  IntUnLockProcessCursorIcons(Win32Process);
 }
 
 /*
@@ -400,14 +400,9 @@ NtUserCreateCursorIconHandle(PICONINFO IconInfo, BOOL Indirect)
   NTSTATUS Status;
   HANDLE Ret;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return (HANDLE)0;
   }
   
@@ -475,14 +470,9 @@ NtUserGetCursorIconInfo(
   NTSTATUS Status;
   BOOL Ret = FALSE;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return FALSE;
   }
   
@@ -537,14 +527,9 @@ NtUserGetCursorIconSize(
   BOOL Ret = FALSE;
   SIZE SafeSize;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return FALSE;
   }
   
@@ -629,14 +614,9 @@ NtUserGetCursorInfo(
     return FALSE;
   }
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return FALSE;
   }
   
@@ -676,15 +656,9 @@ NtUserClipCursor(
   RECT Rect;
   PWINDOW_OBJECT DesktopWindow = NULL;
 
-  NTSTATUS Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				       KernelMode,
-				       0,
-				       &WinStaObject);
-  if (!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if (WinStaObject == NULL)
   {
-    DPRINT1("Validation of window station handle (0x%X) failed\n",
-      PROCESS_WINDOW_STATION());
-    SetLastNtError(Status);
     return FALSE;
   }
 
@@ -739,16 +713,10 @@ NtUserDestroyCursorIcon(
   DWORD Unknown)
 {
   PWINSTATION_OBJECT WinStaObject;
-  NTSTATUS Status;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return FALSE;
   }
   
@@ -777,17 +745,11 @@ NtUserFindExistingCursorIcon(
 {
   PCURICON_OBJECT CurIconObject;
   PWINSTATION_OBJECT WinStaObject;
-  NTSTATUS Status;
   HANDLE Ret = (HANDLE)0;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return Ret;
   }
   
@@ -824,11 +786,8 @@ NtUserGetClipCursor(
   if(!lpRect)
     return FALSE;
 
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-	       KernelMode,
-	       0,
-	       &WinStaObject);
-  if (!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if (WinStaObject == NULL)
   {
     DPRINT("Validation of window station handle (0x%X) failed\n",
       PROCESS_WINDOW_STATION());
@@ -877,15 +836,10 @@ NtUserSetCursor(
   PCURICON_OBJECT CurIconObject;
   HICON OldCursor = (HCURSOR)0;
   PWINSTATION_OBJECT WinStaObject;
-  NTSTATUS Status;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return (HCURSOR)0;
   }
   
@@ -918,14 +872,9 @@ NtUserSetCursorIconContents(
   NTSTATUS Status;
   BOOL Ret = FALSE;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return FALSE;
   }
   
@@ -992,14 +941,9 @@ NtUserSetCursorIconData(
   POINT SafeHotspot;
   BOOL Ret = FALSE;
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return FALSE;
   }
   
@@ -1091,7 +1035,6 @@ NtUserDrawIconEx(
 {
   PCURICON_OBJECT CurIconObject;
   PWINSTATION_OBJECT WinStaObject;
-  NTSTATUS Status;
   HBITMAP hbmMask, hbmColor;
   BITMAP bmpMask, bmpColor;
   BOOL DoFlickerFree;
@@ -1105,14 +1048,9 @@ NtUserDrawIconEx(
   INT nStretchMode;
   #endif
   
-  Status = IntValidateWindowStationHandle(PROCESS_WINDOW_STATION(),
-				                               KernelMode,
-				                               0,
-				                               &WinStaObject);
-  
-  if(!NT_SUCCESS(Status))
+  WinStaObject = IntGetWinStaObj();
+  if(WinStaObject == NULL)
   {
-    SetLastNtError(Status);
     return FALSE;
   }