diff --git a/winsup/cygwin/ChangeLog b/winsup/cygwin/ChangeLog
index 7f4358b2c..303cb1c43 100644
--- a/winsup/cygwin/ChangeLog
+++ b/winsup/cygwin/ChangeLog
@@ -1,3 +1,8 @@
+2002-01-23  Corinna Vinschen  <corinna@vinschen.de>
+
+	* security.cc (create_token): Use sec_user() to create
+	SECURITY_ATTRIBUTES structure for primary token.
+
 2002-01-23  Corinna Vinschen  <corinna@vinschen.de>
 
 	* path.cc (symlink): Fix check for already existing file.
diff --git a/winsup/cygwin/security.cc b/winsup/cygwin/security.cc
index 6bacfdef0..82daa13f8 100644
--- a/winsup/cygwin/security.cc
+++ b/winsup/cygwin/security.cc
@@ -710,7 +710,7 @@ create_token (cygsid &usersid, cygsid &pgrpsid)
     { sizeof sqos, SecurityImpersonation, SECURITY_STATIC_TRACKING, FALSE };
   OBJECT_ATTRIBUTES oa =
     { sizeof oa, 0, 0, 0, 0, &sqos };
-  SECURITY_ATTRIBUTES sa = { sizeof sa, NULL, TRUE };
+  char sa_buf[1024];
   LUID auth_luid = SYSTEM_LUID;
   LARGE_INTEGER exp = { QuadPart:0x7fffffffffffffffLL  };
 
@@ -827,9 +827,8 @@ create_token (cygsid &usersid, cygsid &pgrpsid)
     }
 
   /* Convert to primary token. */
-  if (!DuplicateTokenEx (token, TOKEN_ALL_ACCESS, &sa,
-			 SecurityImpersonation, TokenPrimary,
-			 &primary_token))
+  if (!DuplicateTokenEx (token, MAXIMUM_ALLOWED, sec_user (sa_buf, usersid),
+			 SecurityImpersonation, TokenPrimary, &primary_token))
     __seterrno ();
 
 out: