diff --git a/reactos/ntoskrnl/cm/ntfunc.c b/reactos/ntoskrnl/cm/ntfunc.c
index a1774691927..d100328bd1a 100644
--- a/reactos/ntoskrnl/cm/ntfunc.c
+++ b/reactos/ntoskrnl/cm/ntfunc.c
@@ -30,6 +30,106 @@ FAST_MUTEX CmiCallbackLock;
 
 /* FUNCTIONS ****************************************************************/
 
+NTSTATUS
+NTAPI
+CmpCreateHandle(PVOID ObjectBody,
+                ACCESS_MASK GrantedAccess,
+                ULONG HandleAttributes,
+                PHANDLE HandleReturn)
+                /*
+                * FUNCTION: Add a handle referencing an object
+                * ARGUMENTS:
+                *         obj = Object body that the handle should refer to
+                * RETURNS: The created handle
+                * NOTE: The handle is valid only in the context of the current process
+                */
+{
+    HANDLE_TABLE_ENTRY NewEntry;
+    PEPROCESS Process, CurrentProcess;
+    POBJECT_HEADER ObjectHeader;
+    HANDLE Handle;
+    KAPC_STATE ApcState;
+    BOOLEAN AttachedToProcess = FALSE;
+
+    PAGED_CODE();
+
+    DPRINT("CmpCreateHandle(obj %p)\n",ObjectBody);
+
+    ASSERT(ObjectBody);
+
+    CurrentProcess = PsGetCurrentProcess();
+
+    ObjectHeader = OBJECT_TO_OBJECT_HEADER(ObjectBody);
+
+    /* check that this is a valid kernel pointer */
+    ASSERT((ULONG_PTR)ObjectHeader & EX_HANDLE_ENTRY_LOCKED);
+
+    if (GrantedAccess & MAXIMUM_ALLOWED)
+    {
+        GrantedAccess &= ~MAXIMUM_ALLOWED;
+        GrantedAccess |= GENERIC_ALL;
+    }
+
+    if (GrantedAccess & GENERIC_ACCESS)
+    {
+        RtlMapGenericMask(&GrantedAccess,
+            &ObjectHeader->Type->TypeInfo.GenericMapping);
+    }
+
+    NewEntry.Object = ObjectHeader;
+    if(HandleAttributes & OBJ_INHERIT)
+        NewEntry.ObAttributes |= EX_HANDLE_ENTRY_INHERITABLE;
+    else
+        NewEntry.ObAttributes &= ~EX_HANDLE_ENTRY_INHERITABLE;
+    NewEntry.GrantedAccess = GrantedAccess;
+
+    if ((HandleAttributes & OBJ_KERNEL_HANDLE) &&
+        ExGetPreviousMode == KernelMode)
+    {
+        Process = PsInitialSystemProcess;
+        if (Process != CurrentProcess)
+        {
+            KeStackAttachProcess(&Process->Pcb,
+                &ApcState);
+            AttachedToProcess = TRUE;
+        }
+    }
+    else
+    {
+        Process = CurrentProcess;
+        /* mask out the OBJ_KERNEL_HANDLE attribute */
+        HandleAttributes &= ~OBJ_KERNEL_HANDLE;
+    }
+
+    Handle = ExCreateHandle(Process->ObjectTable,
+        &NewEntry);
+
+    if (AttachedToProcess)
+    {
+        KeUnstackDetachProcess(&ApcState);
+    }
+
+    if(Handle != NULL)
+    {
+        if (HandleAttributes & OBJ_KERNEL_HANDLE)
+        {
+            /* mark the handle value */
+            Handle = ObMarkHandleAsKernelHandle(Handle);
+        }
+
+        if(InterlockedIncrement(&ObjectHeader->HandleCount) == 1)
+        {
+            ObReferenceObject(ObjectBody);
+        }
+
+        *HandleReturn = Handle;
+
+        return STATUS_SUCCESS;
+    }
+
+    return STATUS_UNSUCCESSFUL;
+}
+
 /*
  * @implemented
  */
@@ -291,13 +391,13 @@ NtCreateKey(OUT PHANDLE KeyHandle,
 	  goto Cleanup;
 	}
 
-      Status = ObpCreateHandle(Object,
+      Status = CmpCreateHandle(Object,
 			       DesiredAccess,
 			       ObjectCreateInfo.Attributes,
 			       &hKey);
 
       if (!NT_SUCCESS(Status))
-        DPRINT1("ObpCreateHandle failed Status 0x%x\n", Status);
+        DPRINT1("CmpCreateHandle failed Status 0x%x\n", Status);
 
       PostCreateKeyInfo.Object = NULL;
       PostCreateKeyInfo.Status = Status;
@@ -1361,7 +1461,7 @@ NtOpenKey(OUT PHANDLE KeyHandle,
       goto openkey_cleanup;
     }
 
-  Status = ObpCreateHandle(Object,
+  Status = CmpCreateHandle(Object,
 			   DesiredAccess,
 			   ObjectCreateInfo.Attributes,
 			   &hKey);
diff --git a/reactos/ntoskrnl/ex/init.c b/reactos/ntoskrnl/ex/init.c
index 1bc75f0a42d..a52c2c6173e 100644
--- a/reactos/ntoskrnl/ex/init.c
+++ b/reactos/ntoskrnl/ex/init.c
@@ -426,22 +426,10 @@ ExpLoadInitialProcess(PHANDLE ProcessHandle,
 {
     UNICODE_STRING CurrentDirectory;
     UNICODE_STRING ImagePath = RTL_CONSTANT_STRING(L"\\SystemRoot\\system32\\smss.exe");
-    HANDLE SystemProcessHandle;
     NTSTATUS Status;
     PRTL_USER_PROCESS_PARAMETERS Params=NULL;
     RTL_USER_PROCESS_INFORMATION Info;
 
-    /* Create a handle to the process */
-    Status = ObpCreateHandle(PsInitialSystemProcess,
-                             PROCESS_CREATE_PROCESS | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION,
-                             OBJ_KERNEL_HANDLE,
-                             &SystemProcessHandle);
-    if(!NT_SUCCESS(Status))
-    {
-        DPRINT1("Failed to create a handle for the system process!\n");
-        return Status;
-    }
-
     RtlInitUnicodeString(&CurrentDirectory,
                          SharedUserData->NtSystemRoot);
 
@@ -459,7 +447,6 @@ ExpLoadInitialProcess(PHANDLE ProcessHandle,
     if(!NT_SUCCESS(Status))
     {
         DPRINT1("Failed to create ppb!\n");
-        ZwClose(SystemProcessHandle);
         return Status;
     }
 
@@ -469,14 +456,13 @@ ExpLoadInitialProcess(PHANDLE ProcessHandle,
                                   Params,
                                   NULL,
                                   NULL,
-                                  SystemProcessHandle,
+                                  NULL,
                                   FALSE,
                                   NULL,
                                   NULL,
                                   &Info);
     
     /* Close the handle and free the params */
-    ZwClose(SystemProcessHandle);
     RtlDestroyProcessParameters(Params);
 
     if (!NT_SUCCESS(Status))
diff --git a/reactos/ntoskrnl/include/internal/ob.h b/reactos/ntoskrnl/include/internal/ob.h
index 949666fb239..6677a34f3ea 100644
--- a/reactos/ntoskrnl/include/internal/ob.h
+++ b/reactos/ntoskrnl/include/internal/ob.h
@@ -70,15 +70,6 @@ ObInitSymbolicLinkImplementation(
     VOID
 );
 
-NTSTATUS
-NTAPI
-ObpCreateHandle(
-    PVOID ObjectBody,
-    ACCESS_MASK GrantedAccess,
-    ULONG HandleAttributes,
-    PHANDLE Handle
-);
-
 NTSTATUS
 NTAPI
 ObpCreateHandleTable(
diff --git a/reactos/ntoskrnl/ps/security.c b/reactos/ntoskrnl/ps/security.c
index 8ad95bb0dc3..cb64047fc95 100644
--- a/reactos/ntoskrnl/ps/security.c
+++ b/reactos/ntoskrnl/ps/security.c
@@ -97,10 +97,13 @@ NtOpenProcessTokenEx(IN HANDLE ProcessHandle,
 				 &Token);
    if(NT_SUCCESS(Status))
    {
-     Status = ObpCreateHandle(Token,
-			      DesiredAccess,
-			      HandleAttributes,
-			      &hToken);
+       Status = ObOpenObjectByPointer(Token,
+                                      0,
+                                      NULL,
+                                      DesiredAccess,
+                                      SepTokenObjectType,
+                                      PreviousMode,
+                                      &hToken);
      ObDereferenceObject(Token);
 
      if(NT_SUCCESS(Status))