diff --git a/dlls/ntdll/misc.c b/dlls/ntdll/misc.c
index 7ccaa0ed7fe..2431662a1ec 100644
--- a/dlls/ntdll/misc.c
+++ b/dlls/ntdll/misc.c
@@ -492,3 +492,15 @@ void WINAPI DbgUiRemoteBreakin( void *arg )
 {
     FIXME("stub\n");
 }
+
+NTSTATUS WINAPI NtCreateLowBoxToken(HANDLE *token_handle, HANDLE existing_token_handle, ACCESS_MASK desired_access,
+                                    OBJECT_ATTRIBUTES *object_attributes, SID *package_sid, ULONG capability_count,
+                                    SID_AND_ATTRIBUTES *capabilities, ULONG handle_count, HANDLE *handle)
+{
+    FIXME("(%p, %p, %x, %p, %p, %u, %p, %u, %p): stub\n", token_handle, existing_token_handle, desired_access,
+            object_attributes, package_sid, capability_count, capabilities, handle_count, handle);
+
+    /* We need to return a NULL handle since later it will be passed to CloseHandle and that must not fail */
+    *token_handle = NULL;
+    return STATUS_SUCCESS;
+}
diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
index d321c44d4fc..003e4f9d00a 100644
--- a/dlls/ntdll/ntdll.spec
+++ b/dlls/ntdll/ntdll.spec
@@ -142,6 +142,7 @@
 @ stdcall NtCreateKey(ptr long ptr long ptr long ptr)
 @ stdcall NtCreateKeyTransacted(ptr long ptr long ptr long long ptr)
 @ stdcall NtCreateKeyedEvent(ptr long ptr long)
+@ stdcall NtCreateLowBoxToken(ptr long long ptr ptr long ptr long ptr)
 @ stdcall NtCreateMailslotFile(ptr long ptr ptr long long long ptr)
 @ stdcall NtCreateMutant(ptr long ptr long)
 @ stdcall NtCreateNamedPipeFile(ptr long ptr ptr long long long long long long long long long ptr)