fork() is exposed to user mode, but it's an undocumented private API. Pass the handle of the parent process as the 4th parameter and TRUE as the 5th parameter to NtCreateProcess: http://undocumented.ntinternals.net/index.html?page=UserMode...

The problem is that the Win32 user mode system will fight you every step of the way: CSRSS will not understand what you just did, for example. It's not generally worth it.