diff --git a/winsup/w32api/ChangeLog b/winsup/w32api/ChangeLog
index de57b1166..329e4b54c 100644
--- a/winsup/w32api/ChangeLog
+++ b/winsup/w32api/ChangeLog
@@ -1,3 +1,11 @@
+2009-10-04  Corinna Vinschen  <corinna@vinschen.de>
+
+	* include/winbase.h (CreateRestrictedToken): Declare for >= Win 2000.
+	_WIN32_WINNT >= 0x0500.
+	(DISABLE_MAX_PRIVILEGE, SANDBOX_INERT, LUA_TOKEN,
+	WRITE_RESTRICTED): Define.
+	(IsTokenRestricted): Declare for >= Win 2000.
+
 2009-08-30  Chris Sutcliffe  <ir0nh34d@users.sourceforge.net>
 
 	* include/wtsapi32.h (WTSQuerySessionInformationA,
diff --git a/winsup/w32api/include/winbase.h b/winsup/w32api/include/winbase.h
index 19e41d9a4..3e3eee19e 100644
--- a/winsup/w32api/include/winbase.h
+++ b/winsup/w32api/include/winbase.h
@@ -1260,6 +1260,13 @@ WINBASEAPI BOOL WINAPI CreateProcessWithLogonW (LPCWSTR,LPCWSTR,LPCWSTR,DWORD,
 #define LOGON_NETCREDENTIALS_ONLY 0x00000002
 #endif
 WINBASEAPI HANDLE WINAPI CreateRemoteThread(HANDLE,LPSECURITY_ATTRIBUTES,DWORD,LPTHREAD_START_ROUTINE,LPVOID,DWORD,LPDWORD);
+#if (_WIN32_WINNT >= 0x0500)
+WINBASEAPI BOOL WINAPI CreateRestrictedToken(HANDLE,DWORD,DWORD,PSID_AND_ATTRIBUTES,DWORD,PLUID_AND_ATTRIBUTES,DWORD,PSID_AND_ATTRIBUTES,PHANDLE);
+#define DISABLE_MAX_PRIVILEGE 1
+#define SANDBOX_INERT 2
+#define LUA_TOKEN 4
+#define WRITE_RESTRICTED 8
+#endif
 WINBASEAPI HANDLE WINAPI CreateSemaphoreA(LPSECURITY_ATTRIBUTES,LONG,LONG,LPCSTR);
 WINBASEAPI HANDLE WINAPI CreateSemaphoreW(LPSECURITY_ATTRIBUTES,LONG,LONG,LPCWSTR);
 WINBASEAPI DWORD WINAPI CreateTapePartition(HANDLE,DWORD,DWORD,DWORD);
@@ -1714,6 +1721,9 @@ WINBASEAPI BOOL IsProcessInJob(HANDLE,HANDLE,PBOOL);
 WINBASEAPI BOOL WINAPI IsProcessorFeaturePresent(DWORD);
 WINBASEAPI BOOL WINAPI IsSystemResumeAutomatic(void);
 WINBASEAPI BOOL WINAPI IsTextUnicode(PCVOID,int,LPINT);
+#if (_WIN32_WINNT >= 0x0500)
+WINBASEAPI BOOL WINAPI IsTokenRestricted(HANDLE);
+#endif
 WINBASEAPI BOOL WINAPI IsValidAcl(PACL);
 WINBASEAPI BOOL WINAPI IsValidSecurityDescriptor(PSECURITY_DESCRIPTOR);
 WINBASEAPI BOOL WINAPI IsValidSid(PSID);