I think we should not add ACEs with zero rights to an ACL: $ ls -ld /shares/test drwx------. 2 slow users 4096 Sep 5 15:45 /shares/test $ ./bin/smbcacls -U slow%x //shares/test "" REVISION:1 CONTROL:SR|DP OWNER:SLOWSERVER\slow GROUP:SLOWSERVER\users ACL:SLOWSERVER\slow:ALLOWED/0x0/FULL ACL:SLOWSERVER\users:ALLOWED/0x0/ ACL:Everyone:ALLOWED/0x0/ I think we should just skip the "SLOWSERVER\users" and "Everyone" in this case. Have patch, need bug number.