diff --git a/dlls/kernel/virtual.c b/dlls/kernel/virtual.c
index d3dee1380f7..ef46e30cee2 100644
--- a/dlls/kernel/virtual.c
+++ b/dlls/kernel/virtual.c
@@ -43,6 +43,8 @@
 #include "excpt.h"
 #include "wine/debug.h"
 
+#include "kernel_private.h"
+
 WINE_DEFAULT_DEBUG_CHANNEL(virtual);
 WINE_DECLARE_DEBUG_CHANNEL(seh);
 
@@ -318,6 +320,7 @@ HANDLE WINAPI CreateFileMappingW( HANDLE hFile, LPSECURITY_ATTRIBUTES sa,
     {
         RtlInitUnicodeString( &nameW, name );
         attr.ObjectName = &nameW;
+        attr.RootDirectory = get_BaseNamedObjects_handle();
     }
 
     sec_type = protect & sec_flags;
@@ -406,7 +409,7 @@ HANDLE WINAPI OpenFileMappingW( DWORD access, BOOL inherit, LPCWSTR name)
         return 0;
     }
     attr.Length = sizeof(attr);
-    attr.RootDirectory = 0;
+    attr.RootDirectory = get_BaseNamedObjects_handle();
     attr.ObjectName = &nameW;
     attr.Attributes = OBJ_CASE_INSENSITIVE | (inherit ? OBJ_INHERIT : 0);
     attr.SecurityDescriptor = NULL;
diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c
index 93392f53cd3..d04c79ed0d3 100644
--- a/dlls/ntdll/virtual.c
+++ b/dlls/ntdll/virtual.c
@@ -1662,6 +1662,7 @@ NTSTATUS WINAPI NtCreateSection( HANDLE *handle, ACCESS_MASK access, const OBJEC
     {
         req->access      = access;
         req->attributes  = (attr) ? attr->Attributes : 0;
+        req->rootdir     = attr ? attr->RootDirectory : 0;
         req->file_handle = file;
         req->size_high   = size ? size->u.HighPart : 0;
         req->size_low    = size ? size->u.LowPart : 0;
@@ -1690,6 +1691,7 @@ NTSTATUS WINAPI NtOpenSection( HANDLE *handle, ACCESS_MASK access, const OBJECT_
     {
         req->access  = access;
         req->attributes = (attr) ? attr->Attributes : 0;
+        req->rootdir = attr ? attr->RootDirectory : 0;
         wine_server_add_data( req, attr->ObjectName->Buffer, len );
         if (!(ret = wine_server_call( req ))) *handle = reply->handle;
     }
diff --git a/include/wine/server_protocol.h b/include/wine/server_protocol.h
index 982d8407043..4ab0136c824 100644
--- a/include/wine/server_protocol.h
+++ b/include/wine/server_protocol.h
@@ -1407,6 +1407,7 @@ struct create_mapping_request
     struct request_header __header;
     unsigned int access;
     unsigned int attributes;
+    obj_handle_t rootdir;
     int          size_high;
     int          size_low;
     int          protect;
@@ -1435,6 +1436,7 @@ struct open_mapping_request
     struct request_header __header;
     unsigned int access;
     unsigned int attributes;
+    obj_handle_t rootdir;
     /* VARARG(name,unicode_str); */
 };
 struct open_mapping_reply
@@ -4310,6 +4312,6 @@ union generic_reply
     struct query_symlink_reply query_symlink_reply;
 };
 
-#define SERVER_PROTOCOL_VERSION 204
+#define SERVER_PROTOCOL_VERSION 205
 
 #endif /* __WINE_WINE_SERVER_PROTOCOL_H */
diff --git a/server/mapping.c b/server/mapping.c
index b6e99e456e6..cf8736197f4 100644
--- a/server/mapping.c
+++ b/server/mapping.c
@@ -273,15 +273,16 @@ inline static int get_file_size( struct file *file, file_pos_t *size )
     return 1;
 }
 
-static struct object *create_mapping( const struct unicode_str *name, unsigned int attr,
-                                      file_pos_t size, int protect, obj_handle_t handle )
+static struct object *create_mapping( struct directory *root, const struct unicode_str *name,
+                                      unsigned int attr, file_pos_t size, int protect,
+                                      obj_handle_t handle )
 {
     struct mapping *mapping;
     int access = 0;
 
     if (!page_mask) init_page_size();
 
-    if (!(mapping = create_named_object( sync_namespace, &mapping_ops, name, attr )))
+    if (!(mapping = create_named_object_dir( root, name, attr, &mapping_ops )))
         return NULL;
     if (get_error() == STATUS_OBJECT_NAME_EXISTS)
         return &mapping->obj;  /* Nothing else to do */
@@ -378,25 +379,37 @@ DECL_HANDLER(create_mapping)
 {
     struct object *obj;
     struct unicode_str name;
+    struct directory *root = NULL;
     file_pos_t size = ((file_pos_t)req->size_high << 32) | req->size_low;
 
     reply->handle = 0;
     get_req_unicode_str( &name );
-    if ((obj = create_mapping( &name, req->attributes, size, req->protect, req->file_handle )))
+    if (req->rootdir && !(root = get_directory_obj( current->process, req->rootdir, 0 )))
+        return;
+
+    if ((obj = create_mapping( root, &name, req->attributes, size, req->protect, req->file_handle )))
     {
         reply->handle = alloc_handle( current->process, obj, req->access,
                                       req->attributes & OBJ_INHERIT );
         release_object( obj );
     }
+
+    if (root) release_object( root );
 }
 
 /* open a handle to a mapping */
 DECL_HANDLER(open_mapping)
 {
     struct unicode_str name;
+    struct directory *root = NULL;
 
     get_req_unicode_str( &name );
-    reply->handle = open_object( sync_namespace, &name, &mapping_ops, req->access, req->attributes );
+    if (req->rootdir && !(root = get_directory_obj( current->process, req->rootdir, 0 )))
+        return;
+
+    reply->handle = open_object_dir( root, &name, req->attributes, &mapping_ops, req->access );
+
+    if (root) release_object( root );
 }
 
 /* get a mapping information */
diff --git a/server/protocol.def b/server/protocol.def
index 42282581692..297313c92fe 100644
--- a/server/protocol.def
+++ b/server/protocol.def
@@ -1045,6 +1045,7 @@ enum char_info_mode
 @REQ(create_mapping)
     unsigned int access;        /* wanted access rights */
     unsigned int attributes;    /* object attributes */
+    obj_handle_t rootdir;       /* root directory */
     int          size_high;     /* mapping size */
     int          size_low;      /* mapping size */
     int          protect;       /* protection flags (see below) */
@@ -1068,6 +1069,7 @@ enum char_info_mode
 @REQ(open_mapping)
     unsigned int access;        /* wanted access rights */
     unsigned int attributes;    /* object attributes */
+    obj_handle_t rootdir;       /* root directory */
     VARARG(name,unicode_str);   /* object name */
 @REPLY
     obj_handle_t handle;        /* handle to the mapping */
diff --git a/server/trace.c b/server/trace.c
index 3d4983ac435..5d5159ab133 100644
--- a/server/trace.c
+++ b/server/trace.c
@@ -1448,6 +1448,7 @@ static void dump_create_mapping_request( const struct create_mapping_request *re
 {
     fprintf( stderr, " access=%08x,", req->access );
     fprintf( stderr, " attributes=%08x,", req->attributes );
+    fprintf( stderr, " rootdir=%p,", req->rootdir );
     fprintf( stderr, " size_high=%d,", req->size_high );
     fprintf( stderr, " size_low=%d,", req->size_low );
     fprintf( stderr, " protect=%d,", req->protect );
@@ -1465,6 +1466,7 @@ static void dump_open_mapping_request( const struct open_mapping_request *req )
 {
     fprintf( stderr, " access=%08x,", req->access );
     fprintf( stderr, " attributes=%08x,", req->attributes );
+    fprintf( stderr, " rootdir=%p,", req->rootdir );
     fprintf( stderr, " name=" );
     dump_varargs_unicode_str( cur_size );
 }