diff --git a/src/windows-emulator/handles.hpp b/src/windows-emulator/handles.hpp
index b0f7dd22..c2b8a1d5 100644
--- a/src/windows-emulator/handles.hpp
+++ b/src/windows-emulator/handles.hpp
@@ -274,6 +274,7 @@ constexpr auto KNOWN_DLLS_SYMLINK = make_pseudo_handle(0x1337, handle_types::sym
 constexpr auto SHARED_SECTION = make_pseudo_handle(0x1337, handle_types::section);
 constexpr auto CONSOLE_SERVER = make_pseudo_handle(0x1338, handle_types::section);
 constexpr auto CM_API = make_pseudo_handle(0x1338, handle_types::file);
+constexpr auto KSEC_DD = make_pseudo_handle(0x1339, handle_types::file);
 
 constexpr auto CONSOLE_HANDLE = make_pseudo_handle(0x1, handle_types::file);
 constexpr auto STDOUT_HANDLE = make_pseudo_handle(0x2, handle_types::file);
diff --git a/src/windows-emulator/syscalls.cpp b/src/windows-emulator/syscalls.cpp
index b38ea66f..4dea7a78 100644
--- a/src/windows-emulator/syscalls.cpp
+++ b/src/windows-emulator/syscalls.cpp
@@ -1758,6 +1758,17 @@ namespace
 			return STATUS_SUCCESS;
 		}
 
+		if (filename == L"\\Device\\KsecDD")
+		{
+			file_handle.write(KSEC_DD.bits);
+			return STATUS_SUCCESS;
+		}
+
+		if (filename.starts_with(L"\\Device\\"))
+		{
+			return STATUS_NOT_SUPPORTED;
+		}
+
 		handle root_handle{};
 		root_handle.bits = reinterpret_cast<uint64_t>(attributes.RootDirectory);
 		if (root_handle.value.is_pseudo && (filename == L"\\Reference" || filename == L"\\Connect"))