diff --git a/librpc/idl/security.idl b/librpc/idl/security.idl
index 2f633ab..3378367 100644
--- a/librpc/idl/security.idl
+++ b/librpc/idl/security.idl
@@ -592,6 +592,7 @@ interface security
 		SECINFO_GROUP                = 0x00000002,
 		SECINFO_DACL                 = 0x00000004,
 		SECINFO_SACL                 = 0x00000008,
+		SECINFO_LABEL                = 0x00000010,
 		SECINFO_UNPROTECTED_SACL     = 0x10000000,
 		SECINFO_UNPROTECTED_DACL     = 0x20000000,
 		SECINFO_PROTECTED_SACL	     = 0x40000000,
diff --git a/source3/smbd/nttrans.c b/source3/smbd/nttrans.c
index 427e566..8eb5363 100644
--- a/source3/smbd/nttrans.c
+++ b/source3/smbd/nttrans.c
@@ -866,6 +866,11 @@ NTSTATUS set_sd(files_struct *fsp, uint8_t *data, uint32_t sd_len,
 		security_info_sent &= ~SECINFO_GROUP;
 	}
 
+	if (security_info_sent & SECINFO_LABEL) {
+		/* Just like W2K3 we don't store this. */
+		return NT_STATUS_OK;
+	}
+
 	/* Ensure we have at least one thing set. */
 	if ((security_info_sent & (SECINFO_OWNER|SECINFO_GROUP|SECINFO_DACL|SECINFO_SACL)) == 0) {
 		return NT_STATUS_INVALID_PARAMETER;
@@ -1870,6 +1875,9 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 
 	if (!lp_nt_acl_support(SNUM(conn))) {
 		status = get_null_nt_acl(mem_ctx, &psd);
+	} else if (security_info_wanted & SECINFO_LABEL) {
+		/* Like W2K3 return a null object. */
+		status = get_null_nt_acl(mem_ctx, &psd);
 	} else {
 		status = SMB_VFS_FGET_NT_ACL(
 			fsp, security_info_wanted, &psd);
@@ -1900,6 +1908,15 @@ NTSTATUS smbd_do_query_security_desc(connection_struct *conn,
 	    security_info_wanted & SECINFO_DACL)
 		psd->type |= SEC_DESC_DACL_PRESENT;
 
+	if (security_info_wanted & SECINFO_LABEL) {
+		/* Like W2K3 return a null object. */
+		psd->owner_sid = NULL;
+		psd->group_sid = NULL;
+		psd->dacl = NULL;
+		psd->sacl = NULL;
+		psd->type &= ~(SEC_DESC_DACL_PRESENT|SEC_DESC_SACL_PRESENT);
+	}
+
 	*psd_size = ndr_size_security_descriptor(psd, 0);
 
 	DEBUG(3,("smbd_do_query_security_desc: sd_size = %lu.\n",