diff --git a/reactos/subsys/csrss/api/handle.c b/reactos/subsys/csrss/api/handle.c
index faa8c3ef663..5286f29db86 100644
--- a/reactos/subsys/csrss/api/handle.c
+++ b/reactos/subsys/csrss/api/handle.c
@@ -123,8 +123,10 @@ CsrReleaseObject(PCSRSS_PROCESS_DATA ProcessData,
     }
 
   Status = CsrReleaseObjectByPointer(ProcessData->HandleTable[h]);
-  ProcessData->HandleTable[h] = 0;
 
+  RtlEnterCriticalSection(&ProcessData->HandleTableLock);
+  ProcessData->HandleTable[h] = 0;
+  RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
   return Status;
 }
 
@@ -138,33 +140,36 @@ NTSTATUS STDCALL CsrInsertObject( PCSRSS_PROCESS_DATA ProcessData, PHANDLE Handl
       return STATUS_INVALID_PARAMETER;
    }
 
+   RtlEnterCriticalSection(&ProcessData->HandleTableLock);
+
    for (i = 0; i < ProcessData->HandleTableSize; i++)
      {
 	if (ProcessData->HandleTable[i] == NULL)
 	  {
-	     ProcessData->HandleTable[i] = Object;
-	     *Handle = (HANDLE)(((i + 1) << 2) | 0x3);
-	     InterlockedIncrement( &Object->ReferenceCount );
-	     return(STATUS_SUCCESS);
+            break;
 	  }
      }
-   NewBlock = RtlAllocateHeap(CsrssApiHeap,
-			      HEAP_ZERO_MEMORY,
-			      (ProcessData->HandleTableSize + 64) *
-			      sizeof(HANDLE));
-   if (NewBlock == NULL)
+   if (i >= ProcessData->HandleTableSize)
      {
-	return(STATUS_UNSUCCESSFUL);
+       NewBlock = RtlAllocateHeap(CsrssApiHeap,
+			          HEAP_ZERO_MEMORY,
+			          (ProcessData->HandleTableSize + 64) * sizeof(HANDLE));
+       if (NewBlock == NULL)
+         {
+           RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
+	   return(STATUS_UNSUCCESSFUL);
+         }
+       RtlCopyMemory(NewBlock,
+		     ProcessData->HandleTable,
+		     ProcessData->HandleTableSize * sizeof(HANDLE));
+       RtlFreeHeap( CsrssApiHeap, 0, ProcessData->HandleTable );
+       ProcessData->HandleTable = (Object_t **)NewBlock;
+       ProcessData->HandleTableSize += 64;
      }
-   RtlCopyMemory(NewBlock,
-		 ProcessData->HandleTable,
-		 ProcessData->HandleTableSize * sizeof(HANDLE));
-   RtlFreeHeap( CsrssApiHeap, 0, ProcessData->HandleTable );
-   ProcessData->HandleTable = (Object_t **)NewBlock;
    ProcessData->HandleTable[i] = Object;
    *Handle = (HANDLE)(((i + 1) << 2) | 0x3);
    InterlockedIncrement( &Object->ReferenceCount );
-   ProcessData->HandleTableSize = ProcessData->HandleTableSize + 64;
+   RtlLeaveCriticalSection(&ProcessData->HandleTableLock);
    return(STATUS_SUCCESS);
 }
 
diff --git a/reactos/subsys/csrss/api/process.c b/reactos/subsys/csrss/api/process.c
index 01159854987..79849f39b67 100644
--- a/reactos/subsys/csrss/api/process.c
+++ b/reactos/subsys/csrss/api/process.c
@@ -103,7 +103,8 @@ PCSRSS_PROCESS_DATA STDCALL CsrCreateProcessData(HANDLE ProcessId)
             ProcessData[hash] = pProcessData->next;
 	    RtlFreeHeap(CsrssApiHeap, 0, pProcessData);
 	    pProcessData = NULL;
-        }
+         }
+         RtlInitializeCriticalSection(&pProcessData->HandleTableLock);
       }
    }
    else
@@ -160,6 +161,7 @@ NTSTATUS STDCALL CsrFreeProcessData(HANDLE Pid)
             }
           RtlFreeHeap(CsrssApiHeap, 0, pProcessData->HandleTable);
         }
+      RtlDeleteCriticalSection(&pProcessData->HandleTableLock);
       if (pProcessData->Console)
         {
           CsrReleaseObjectByPointer((Object_t *) pProcessData->Console);
@@ -254,7 +256,6 @@ CSR_API(CsrCreateProcess)
        if( !NT_SUCCESS( Status ) )
 	 {
 	   DbgPrint( "CSR: NtDuplicateObject() failed: %x\n", Status );
-	   InterlockedDecrement( &(NewProcessData->Console->Header.ReferenceCount) );
 	   CsrFreeProcessData( NewProcessData->ProcessId );
 	   Reply->Status = Status;
 	   return Status;
diff --git a/reactos/subsys/csrss/include/api.h b/reactos/subsys/csrss/include/api.h
index 520bbc3733f..ae4bdc1fa90 100644
--- a/reactos/subsys/csrss/include/api.h
+++ b/reactos/subsys/csrss/include/api.h
@@ -34,6 +34,7 @@ typedef struct tagCSRSS_CONSOLE *PCSRSS_CONSOLE;
 typedef struct _CSRSS_PROCESS_DATA
 {
   PCSRSS_CONSOLE Console;
+  RTL_CRITICAL_SECTION HandleTableLock;
   ULONG HandleTableSize;
   Object_t ** HandleTable;
   HANDLE ProcessId;