diff --git a/reactos/ntoskrnl/po/events.c b/reactos/ntoskrnl/po/events.c
index 2caae544191..fb778ff9c99 100644
--- a/reactos/ntoskrnl/po/events.c
+++ b/reactos/ntoskrnl/po/events.c
@@ -209,7 +209,7 @@ PopAddRemoveSysCapsCallback(IN PVOID NotificationStructure,
 			FileHandle,
 			FILE_READ_DATA,
 			IoFileObjectType,
-			ExGetPreviousMode(),
+			KernelMode,
 			(PVOID*)&FileObject,
 			NULL);
 		if (!NT_SUCCESS(Status))