diff --git a/dlls/ntdll/ntdll.spec b/dlls/ntdll/ntdll.spec
index 32a2a73cf34..52db956144e 100644
--- a/dlls/ntdll/ntdll.spec
+++ b/dlls/ntdll/ntdll.spec
@@ -178,7 +178,7 @@
 # @ stub NtGetDevicePowerState
 @ stub NtGetPlugPlayEvent
 @ stdcall NtGetTickCount()
-# @ stub NtGetWriteWatch
+@ stdcall NtGetWriteWatch(long long ptr long ptr ptr ptr)
 @ stub NtImpersonateAnonymousToken
 @ stub NtImpersonateClientOfPort
 @ stub NtImpersonateThread
@@ -298,7 +298,7 @@
 @ stdcall NtRequestWaitReplyPort(ptr ptr ptr)
 # @ stub NtRequestWakeupLatency
 @ stdcall NtResetEvent(long ptr)
-# @ stub NtResetWriteWatch
+@ stdcall NtResetWriteWatch(long ptr long)
 @ stdcall NtRestoreKey(long long long)
 # @ stub NtResumeProcess
 @ stdcall NtResumeThread(long long)
@@ -1022,7 +1022,7 @@
 # @ stub ZwGetDevicePowerState
 @ stub ZwGetPlugPlayEvent
 @ stdcall ZwGetTickCount() NtGetTickCount
-# @ stub ZwGetWriteWatch
+@ stdcall ZwGetWriteWatch(long long ptr long ptr ptr ptr) NtGetWriteWatch
 # @ stub ZwImpersonateAnonymousToken
 @ stub ZwImpersonateClientOfPort
 @ stub ZwImpersonateThread
@@ -1142,7 +1142,7 @@
 @ stdcall ZwRequestWaitReplyPort(ptr ptr ptr) NtRequestWaitReplyPort
 # @ stub ZwRequestWakeupLatency
 @ stdcall ZwResetEvent(long ptr) NtResetEvent
-# @ stub ZwResetWriteWatch
+@ stdcall ZwResetWriteWatch(long ptr long) NtResetWriteWatch
 @ stdcall ZwRestoreKey(long long long) NtRestoreKey
 # @ stub ZwResumeProcess
 @ stdcall ZwResumeThread(long long) NtResumeThread
diff --git a/dlls/ntdll/virtual.c b/dlls/ntdll/virtual.c
index 21da9afede8..7a12da2b1b0 100644
--- a/dlls/ntdll/virtual.c
+++ b/dlls/ntdll/virtual.c
@@ -1551,7 +1551,7 @@ NTSTATUS WINAPI NtAllocateVirtualMemory( HANDLE process, PVOID *ret, ULONG zero_
         if (type & MEM_WRITE_WATCH)
         {
             FIXME("MEM_WRITE_WATCH type not supported\n");
-            return STATUS_NOT_SUPPORTED;
+            return STATUS_INVALID_PARAMETER;
         }
     }
     vprot = VIRTUAL_GetProt( protect ) | VPROT_VALLOC;
@@ -2346,6 +2346,29 @@ NTSTATUS WINAPI NtFlushVirtualMemory( HANDLE process, LPCVOID *addr_ptr,
 }
 
 
+/***********************************************************************
+ *             NtGetWriteWatch   (NTDLL.@)
+ *             ZwGetWriteWatch   (NTDLL.@)
+ */
+NTSTATUS WINAPI NtGetWriteWatch( HANDLE process, ULONG flags, PVOID base, SIZE_T size, PVOID *addresses,
+                                 ULONG_PTR *count, ULONG *granularity )
+{
+    FIXME( "%p %x %p-%p %p %lu\n", process, flags, base, (char *)base + size, addresses, *count );
+    return STATUS_NOT_IMPLEMENTED;
+}
+
+
+/***********************************************************************
+ *             NtResetWriteWatch   (NTDLL.@)
+ *             ZwResetWriteWatch   (NTDLL.@)
+ */
+NTSTATUS WINAPI NtResetWriteWatch( HANDLE process, PVOID base, SIZE_T size )
+{
+    FIXME( "%p %p-%p\n", process, base, (char *)base + size );
+    return STATUS_NOT_IMPLEMENTED;
+}
+
+
 /***********************************************************************
  *             NtReadVirtualMemory   (NTDLL.@)
  *             ZwReadVirtualMemory   (NTDLL.@)
diff --git a/include/winternl.h b/include/winternl.h
index 25a205a1a75..3968e243b28 100644
--- a/include/winternl.h
+++ b/include/winternl.h
@@ -1920,6 +1920,7 @@ NTSYSAPI NTSTATUS  WINAPI NtFsControlFile(HANDLE,HANDLE,PIO_APC_ROUTINE,PVOID,PI
 NTSYSAPI NTSTATUS  WINAPI NtGetContextThread(HANDLE,CONTEXT*);
 NTSYSAPI NTSTATUS  WINAPI NtGetPlugPlayEvent(ULONG,ULONG,PVOID,ULONG);
 NTSYSAPI ULONG     WINAPI NtGetTickCount(VOID);
+NTSYSAPI NTSTATUS  WINAPI NtGetWriteWatch(HANDLE,ULONG,PVOID,SIZE_T,PVOID*,ULONG_PTR*,ULONG*);
 NTSYSAPI NTSTATUS  WINAPI NtImpersonateAnonymousToken(HANDLE);
 NTSYSAPI NTSTATUS  WINAPI NtImpersonateClientOfPort(HANDLE,PPORT_MESSAGE);
 NTSYSAPI NTSTATUS  WINAPI NtImpersonateThread(HANDLE,HANDLE,PSECURITY_QUALITY_OF_SERVICE);
@@ -2015,6 +2016,7 @@ NTSYSAPI NTSTATUS  WINAPI NtReplyWaitReplyPort(HANDLE,PLPC_MESSAGE);
 NTSYSAPI NTSTATUS  WINAPI NtRequestPort(HANDLE,PLPC_MESSAGE);
 NTSYSAPI NTSTATUS  WINAPI NtRequestWaitReplyPort(HANDLE,PLPC_MESSAGE,PLPC_MESSAGE);
 NTSYSAPI NTSTATUS  WINAPI NtResetEvent(HANDLE,PULONG);
+NTSYSAPI NTSTATUS  WINAPI NtResetWriteWatch(HANDLE,PVOID,SIZE_T);
 NTSYSAPI NTSTATUS  WINAPI NtRestoreKey(HANDLE,HANDLE,ULONG);
 NTSYSAPI NTSTATUS  WINAPI NtResumeThread(HANDLE,PULONG);
 NTSYSAPI NTSTATUS  WINAPI NtSaveKey(HANDLE,HANDLE);