diff --git a/reactos/subsystems/win32/win32k/ntuser/keyboard.c b/reactos/subsystems/win32/win32k/ntuser/keyboard.c
index c4ef0430555..0583b0c9841 100644
--- a/reactos/subsystems/win32/win32k/ntuser/keyboard.c
+++ b/reactos/subsystems/win32/win32k/ntuser/keyboard.c
@@ -486,55 +486,6 @@ IntTranslateKbdMessage(LPMSG lpMsg,
    return Result;
 }
 
-DWORD
-APIENTRY
-NtUserGetKeyboardState(
-   LPBYTE lpKeyState)
-{
-   BOOL Result = TRUE;
-   DECLARE_RETURN(DWORD);
-
-   DPRINT("Enter NtUserGetKeyboardState\n");
-   UserEnterShared();
-
-   if (lpKeyState)
-   {
-      if(!NT_SUCCESS(MmCopyToCaller(lpKeyState, gQueueKeyStateTable, 256)))
-         Result = FALSE;
-   }
-
-   RETURN(Result);
-
-CLEANUP:
-   DPRINT("Leave NtUserGetKeyboardState, ret=%i\n",_ret_);
-   UserLeave();
-   END_CLEANUP;
-}
-
-BOOL
-APIENTRY
-NtUserSetKeyboardState(LPBYTE lpKeyState)
-{
-   BOOL Result = TRUE;
-   DECLARE_RETURN(DWORD);
-
-   DPRINT("Enter NtUserSetKeyboardState\n");
-   UserEnterExclusive();
-
-   if (lpKeyState)
-   {
-      if(! NT_SUCCESS(MmCopyFromCaller(gQueueKeyStateTable, lpKeyState, 256)))
-         Result = FALSE;
-   }
-
-   RETURN(Result);
-
-CLEANUP:
-   DPRINT("Leave NtUserSetKeyboardState, ret=%i\n",_ret_);
-   UserLeave();
-   END_CLEANUP;
-}
-
 static UINT VkToScan( UINT Code, BOOL ExtCode, PKBDTABLES pkKT )
 {
    int i;
diff --git a/reactos/subsystems/win32/win32k/ntuser/msgqueue.c b/reactos/subsystems/win32/win32k/ntuser/msgqueue.c
index 136effff6e5..90b11a9f017 100644
--- a/reactos/subsystems/win32/win32k/ntuser/msgqueue.c
+++ b/reactos/subsystems/win32/win32k/ntuser/msgqueue.c
@@ -1896,4 +1896,66 @@ NtUserGetKeyState(INT key)
    return Ret;
 }
 
+
+DWORD
+APIENTRY
+NtUserGetKeyboardState(LPBYTE lpKeyState)
+{
+   DWORD ret = TRUE;
+   PTHREADINFO pti;
+   PUSER_MESSAGE_QUEUE MessageQueue;
+
+   UserEnterShared();
+
+   pti = PsGetCurrentThreadWin32Thread();
+   MessageQueue = pti->MessageQueue;
+
+   _SEH2_TRY
+   {
+       ProbeForWrite(lpKeyState,sizeof(MessageQueue->KeyState) ,1);
+       RtlCopyMemory(lpKeyState,MessageQueue->KeyState,sizeof(MessageQueue->KeyState));
+   }
+   _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+   {
+       SetLastNtError(_SEH2_GetExceptionCode());
+       ret = FALSE;
+   }
+   _SEH2_END;
+
+   UserLeave();
+
+   return ret;
+}
+
+BOOL
+APIENTRY
+NtUserSetKeyboardState(LPBYTE lpKeyState)
+{
+   DWORD ret = TRUE;
+   PTHREADINFO pti;
+   PUSER_MESSAGE_QUEUE MessageQueue;
+
+   UserEnterExclusive();
+
+   pti = PsGetCurrentThreadWin32Thread();
+   MessageQueue = pti->MessageQueue;
+
+   _SEH2_TRY
+   {
+       ProbeForRead(lpKeyState,sizeof(MessageQueue->KeyState) ,1);
+       RtlCopyMemory(MessageQueue->KeyState,lpKeyState,sizeof(MessageQueue->KeyState));
+   }
+   _SEH2_EXCEPT(EXCEPTION_EXECUTE_HANDLER)
+   {
+       SetLastNtError(_SEH2_GetExceptionCode());
+       ret = FALSE;
+   }
+   _SEH2_END;
+
+   UserLeave();
+
+   return ret;
+}
+
+
 /* EOF */